[acamarata]

D-1482: E2E Golden Path scheduled run red, no report

Run 40261854806 (schedule, 2026-10-26, head 41dad92) was checked line by line. The row's description does not match it, so this PR fixes what the log shows plus the trap the row asked for.

What the run actually did

• Run golden-path smoke wrote its report (Report written to /tmp/golden-path-report.json, artifact uploaded). Step 9 (plugin install ai) failed with [E124] checksum mismatch. This is the registry/tarball problem (plugin tarballs are not reproducible), not a cli bug; it is NOT fixed here.
• The "no golden-path-report.json was produced" text in the log is the summary step's own shell source being echoed, not output.
• The exit 1 after the acc3 PASS lines is the Cascade integration suite step: live-safety-smoke.sh printed 46 assertions: 45 passed, 1 failed. The one failure was acc1 live-safety-fixture.sh exited 1 / the rewritten plugin fragment is not a plan artifact.

Changes

1. scripts/ci/live-safety-fixture.sh: the fixture still expected the plan artifact @plugins/nself-alpha/docker-compose.plugin.yml. Since D-0318 (fix(build): isolate plugin compose normalizations in the project overlay (D-0318) #849) the build writes the rewritten fragment to the project overlay .nself/plugins/<name>/docker-compose.plugin.yml. Reproduced on origin/main (plan lists the overlay path, no @plugins/ key); with the assertion corrected the plugin-fragment cases pass.
2. scripts/golden-path.sh: report written from the EXIT trap. When the script exits non-zero with no failed step (missing prerequisite, signal, unbound variable), the first unfinished step is marked fail with the reason and the report is rewritten. A report that already names a failed step is left alone. HUP/INT/TERM exit through the trap.
3. scripts/ci/golden-path_test.sh (new, wired into ci.yml): missing prerequisite, SIGTERM during the health wait, and a deliberate health timeout keeping its own note. Against origin/main's script the first case fails (no report written); with the change all three pass.

Not fixed (out of scope)

• Step 9 checksum mismatch (plugins registry/tarballs).
• GOLDEN_PATH_DRY_RUN=1 cannot pass: step 6 cds into a project dir the dry run never created. Noted for a separate row.

Commands run

• go build -mod=vendor -o <tmp>/nself ./cmd/nself, then build --plan --json on the dev-plugin fixture: artifact path confirmed.
• live-safety-fixture.sh with a stub docker (no daemon here): every ok through plugin fragment edited after the plan: E450; the final unknown Docker state read as empty case needs a real unreachable daemon and fails only because of the stub. CI has real Docker.
• bash scripts/ci/golden-path_test.sh: 3/3 ok (about 10s).
• bash scripts/ci/workflow-lint.sh, actionlint .github/workflows/ci.yml, bash scripts/ci/flag-drift-audit.sh: pass. shellcheck -S warning: no new findings (one pre-existing SC2034 in golden-path.sh).
• Not run here: the real Docker smoke (no daemon on the worker).