fix(gate): [5/7] hid the runner's exit code exactly when it explained everything

The line naming a nonzero `go test` status was printed only when every
privileged test had produced a verdict — on the reasoning that a named FAILED
already explains the status. The case that actually happens is the opposite
one: the run dies at package level, so it names no test, so the loop above
prints MISSING for all of them, and the one line pointing at the real cause was
the one suppressed. A reader then goes hunting for three vanished tests instead
of at the build error above.

To be exact about what was and was not broken, because the framing matters: the
exit status was never SWALLOWED. priv_bad is set by the MISSING branch, so
FAILED is set and the gate fails either way — this was a diagnosis bug, not a
correctness one. What changes is whether the log says why.

Verified on the branch a green run never reaches, by driving the edited block
with all four (priv_rc, priv_bad) combinations: the new message appears only for
(1,1), the old one only for (1,0), and priv_bad/FAILED come out 1 in both. The
full gate is green with the change in, which covers the (0,0) path.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BHw89tdWddzhjUc4bAH4tS

scripts/run-tests.sh

@@ -721,9 +721,25 @@ else
 			priv_bad=1
 		fi
 	done <<<"$priv_expect"
-	if [ "$priv_rc" -ne 0 ] && [ "$priv_bad" -eq 0 ]; then
-		echo "  FAILED [privileged]: go test exited $priv_rc with every named test accounted for —" >&2
-		echo "          a build or package-level failure, see the log above." >&2
+	# The runner's own exit status is reported WHATEVER the per-name verdicts say.
+	# It used to be reported only when every name was accounted for, on the
+	# reasoning that a named failure already explains the status — but the case
+	# that actually happens is the opposite one: the run dies at package level, the
+	# loop above prints MISSING for every name because none of them produced a
+	# verdict, and the one line naming the cause was the one suppressed. A reader
+	# then goes looking for three vanished tests instead of at the build error.
+	# Same verdict either way (priv_bad, hence FAILED, is set in both branches) —
+	# what changes is whether the log says why.
+	if [ "$priv_rc" -ne 0 ]; then
+		if [ "$priv_bad" -eq 0 ]; then
+			echo "  FAILED [privileged]: go test exited $priv_rc with every named test accounted for —" >&2
+			echo "          a build or package-level failure, see the log above." >&2
+		else
+			echo "  FAILED [privileged]: go test exited $priv_rc as well — the verdicts above are" >&2
+			echo "          the symptom. A run that dies at package level names no test, so" >&2
+			echo "          MISSING lines are what that looks like from here; the cause is in" >&2
+			echo "          the log above, not in the tests they name." >&2
+		fi
 		priv_bad=1
 	fi
 	if [ "$priv_bad" -ne 0 ]; then