fix(ci): dogfood gate passes cancelled runs through — a cancelled matrix is not a failed one (#3671)

Closes #3668. With cancel-in-progress on, every consecutive push cancelled
the in-flight dogfood matrix (the longest job in the workflow) and the
gate's catch-all branch turned that into a red X on the superseded SHA —
two observed on #3660 alone. False reds train everyone to ignore the one
check that must never be ignored.

Safety premise verified experimentally before landing (per the issue's own
ask): run 30271824408 executed a fail-fast matrix where shard 1 really
failed and fail-fast cancelled shard 2 mid-run — the aggregate
needs.<job>.result reads 'failure', not 'cancelled'. Failure dominates, so
an aggregate of 'cancelled' can only come from the whole run being stopped
externally (supersession or manual cancel) and passing it masks no real
regression. The manual-cancel case going green is the issue's accepted
trade-off; the rejected alternative (skipping the gate via !cancelled())
would republish the #3622 required-context deadlock.


Claude-Session: https://claude.ai/code/session_01ECTCrcCdZpCHw5zFSgcmGt

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

.changeset/dogfood-gate-cancelled-not-failure.md

@@ -0,0 +1,4 @@
+---
+---
+
+CI-only: the Dogfood Regression Gate no longer reports a superseded (cancelled) run as a failure — `cancelled` joins the pass branch, backed by a fail-fast experiment showing a real shard failure always aggregates as `failure`. Releases nothing.

.github/workflows/ci.yml

@@ -286,8 +286,21 @@ jobs:
         run: |
           result="${{ needs.dogfood.result }}"
           echo "dogfood matrix aggregate result: $result"
+          # cancelled is a run-lifecycle state, not a shard verdict (#3668):
+          # with cancel-in-progress on, every superseded push cancelled the
+          # in-flight dogfood matrix — the longest job, so almost always the
+          # one still running — and the old `*)` fallthrough painted a false
+          # red on the old SHA. Verified experimentally (run 30271824408, a
+          # fail-fast matrix with one real failure + one cancelled sibling):
+          # a real shard failure DOMINATES the aggregate — it reads "failure",
+          # never "cancelled" — so "cancelled" here can only mean the whole
+          # run was stopped from outside (supersession, or a manual cancel —
+          # accepted trade-off), and passing it masks no regression.
+          # Deliberately NOT `if: !cancelled()` on the job instead: a skipped
+          # gate publishes no required-check context on the SHA, which is the
+          # #3622 merge-deadlock all over again.
           case "$result" in
-            success|skipped) echo "Dogfood gate satisfied." ;;
+            success|skipped|cancelled) echo "Dogfood gate satisfied ($result)." ;;
             *) echo "::error::Dogfood shards did not pass (aggregate result: $result)"; exit 1 ;;
           esac