fix(maintenance): the sweep ran under bash -e and could not report a finding

[rldyourmnd]

Found by running it

PR #172 made maintenance.yml able to fetch tags and file an issue. I then dispatched
it — the first execution in its life. It failed, and the log shows why:

advisory sweep  Run the advisory sweep  shell: /usr/bin/bash -e {0}
advisory sweep  Run the advisory sweep  check_python_syntax: OK
advisory sweep  Run the advisory sweep  ##[error]Process completed with exit code 1.

Note what is missing: no cat sweep.txt, no status=. The step died at the sweep
line itself.

The defect

GitHub runs run: steps as bash -e {0}. -e arrives on the shell's own command
line, where no set inside the script can reach it. The step said:

set -uo pipefail
...
# Deliberately not `set -e`: a finding is the expected outcome and
# must be reported, not abort the job before it can be filed.

That comment was false. set -uo pipefail does not remove an -e that the shell was
invoked with. So on the first finding — the only time this job matters — bash aborted
before status=$?, $GITHUB_OUTPUT never received a status, and the report step had
nothing to act on. No if: on that step either, so a failed sweep skipped reporting
altogether.

Three layers of the same shape: the reporting mechanism was unreachable in exactly
the case it exists for.

Fix

• shell: bash {0} on the sweep step — the documented way to get a bash without -e.
• if: always() on the report step.
• An empty status is treated as a finding, not as silence. An advisory lane whose
  findings vanish looks identical to one with nothing to say.

Proof

The contract now resolves the effective shell the way GitHub does — step, then job
defaults.run.shell, then workflow defaults, then bash -e {0} — and executes the
sweep step under it with a stub interpreter, asserting the exit code reaches
$GITHUB_OUTPUT for both a clean sweep and a finding.

Mutation	Result
shell reverts to the GitHub default (bash -e)	RED (caught)
shell declared as plain bash (expands to -eo pipefail)	RED (caught)
report step stops running unconditionally	RED (caught)

The second case matters: shell: bash looks like a fix and is not — it expands to
bash --noprofile --norc -eo pipefail {0}.

Still unknown

What the sweep actually found on the runner is still unknown, because the step died
before printing sweep.txt. Locally all three tiers are green. I will re-run
maintenance.yml after this merges and report what it says.

Verification

• validate_all — all three tiers OK with GH_TOKEN
• actionlint — clean · zizmor@1.26.1 --persona pedantic --min-severity low — no findings