Annotate nextest failures in CI

Capture nextest output in rust-ci and emit parsed FAIL/LEAK lines as annotations and step-summary text when tests fail.

Also record the isolated Linux test failure on b6e18d2e8 in the flaky-test ledger.

Co-authored-by: Codex <noreply@openai.com>

.codex/flaky-test-triage.md

@@ -77,3 +77,4 @@ Older failures also appeared on Linux, but the repeated cross-PR signal is stron
 | `13c9d91b0` | Avoid false matches in permissions popup helper | failed | Run `23081377233` fixed the Linux/macOS/Bazel regression, but both Windows `Tests` jobs still failed. Signed log downloads from both `results-receiver.actions.githubusercontent.com` and the Azure blob log URL hit TLS EOFs in this environment, so the remaining diagnosis comes from CI history plus the test diff: the default unelevated Windows popup still opens on `Read Only`, and the new exact-selection assertions were assuming `Default`. |
 | `c3b8a0ebf` | Correct Windows popup selection assertions | full pass | Full PR CI passed on run `23081835533`, including both Windows `Tests` jobs and Bazel. The Windows-only initial-selection assertions now expect `Read Only` when the unelevated popup opens on Windows. This restarts the passing streak at 1 of 5 after the intervening failed commits. |
 | `9835ec89d` | Record validation pass 1 | full pass | Full PR CI passed on run `23082212165`, including the rerun of `Tests — windows-arm64 - aarch64-pc-windows-msvc` on job `67054619213`. The branch now has 2 consecutive full-suite green commits after `c3b8a0ebf`. |
+| `b6e18d2e8` | Record validation pass 2 | failed | Run `23083106021` isolated a new failure in `Tests — ubuntu-24.04 - x86_64-unknown-linux-gnu` while both Windows `Tests` jobs and all Bazel/lint checks passed. The GitHub CLI log download hit EOFs on both `results-receiver.actions.githubusercontent.com` and the signed Azure blob URL again, so the follow-up commit adds CI annotations and step-summary output for parsed nextest `FAIL`/`LEAK` lines. |

.github/workflows/rust-ci.yml

@@ -598,7 +598,42 @@ jobs:
 
       - name: tests
         id: test
-        run: cargo nextest run --all-features --no-fail-fast --target ${{ matrix.target }} --cargo-profile ci-test --timings
+        shell: bash
+        run: |
+          set -euo pipefail
+          log_file="$(mktemp)"
+          trap 'rm -f "$log_file"' EXIT
+
+          set +e
+          cargo nextest run --all-features --no-fail-fast --target ${{ matrix.target }} --cargo-profile ci-test --timings 2>&1 | tee "$log_file"
+          status=${PIPESTATUS[0]}
+          set -e
+
+          if [[ $status -ne 0 ]]; then
+            summary_lines="$(grep -E '^(FAIL|LEAK)([[:space:]]|$)' "$log_file" || true)"
+            if [[ -n "$summary_lines" ]]; then
+              {
+                echo "### nextest failure summary"
+                echo '```text'
+                printf '%s\n' "$summary_lines"
+                echo '```'
+              } >> "$GITHUB_STEP_SUMMARY"
+
+              while IFS= read -r line; do
+                echo "::error::$line"
+              done <<< "$summary_lines"
+            else
+              {
+                echo "### nextest failure tail"
+                echo '```text'
+                tail -n 200 "$log_file"
+                echo '```'
+              } >> "$GITHUB_STEP_SUMMARY"
+              echo "::error::nextest failed without a parsable FAIL/LEAK line; inspect the tail in the step summary"
+            fi
+          fi
+
+          exit $status
         env:
           RUST_BACKTRACE: 1
           NEXTEST_STATUS_LEVEL: leak