ci: make test-linux-unit a blocking gate (was soft-fail) (#30)

PR #26 (the bootstrap trusted-publisher API) merged with broken master
on 2026-07-10. The CI gate that should have caught it was:

    continue-on-error: true
    ...
    ctest --output-on-failure || true

Both protections combined: continue-on-error ignored a non-zero exit,
and `|| true` flattened any failure to exit 0 anyway. Result: PR #26
landed broken, PR #27 (script fuzz) inherited the breakage, and the
next 7 push cycles spent debugging CI failures that should have been
caught at PR-merge time.

This commit:
1. Drops `continue-on-error: true` on test-linux-unit (the soft-gate)
2. Drops `|| true` from the ctest invocation
3. Adds explanatory comments pointing to the PR #26 incident

The job is now a real CI gate: a unit-test regression blocks the PR.
If a single test turns out to be flaky on the CI runner, we should
fix the test (it'll be flaky locally too) rather than weaken the gate.

Companion jobs (test-linux-sanitizers, test-fuzz-smoke) were already
blocking. This brings test-linux-unit in line with them.

Co-authored-by: Sami Ahmed <sami@sami-ahmed.net>

.github/workflows/build-all.yml

@@ -10,8 +10,13 @@ on:
 
 jobs:
   test-linux-unit:
+    # This is the canonical CI gate for unit tests. Failures here MUST block
+    # the PR — see PR #26 incident (2026-07-11): the previous
+    # `continue-on-error: true` + `|| true` soft-gate allowed a PR with broken
+    # master-side code to merge because the link failure wasn't blocking.
+    # Sanitizer regression = blocking PR (test-linux-sanitizers below).
+    # Unit regression = blocking PR (this job).
     runs-on: ubuntu-22.04
-    continue-on-error: true
     steps:
       - uses: actions/checkout@v4
         with:
@@ -85,7 +90,11 @@ jobs:
           fi
 
       - name: Run unit tests
-        run: cd build && ctest --output-on-failure || true
+        # ctest exit code is the gate. NO `|| true` — failures must block
+        # the PR (see comment at top of this job). --output-on-failure gives
+        # the failing assertion + suite name inline rather than requiring a
+        # log download.
+        run: cd build && ctest --output-on-failure
 
   test-linux-sanitizers:
     # ASan + UBSan build of the daemon + unit tests. This is a blocking