fix(upgrade): capture an AGENTS.md composition failure instead of aborting on it

[chubes4]

Fixes #607.

The problem

upgrade.sh runs under set -e (line 63). regenerate_agents_md is the only phase function in it with a non-zero return path, and it was called bare. So a failed datamachine memory compose did not degrade the run — it ended it, at that line:

regenerate_agents_md            ← returns 1, script exits here
runtime_guidance_sync_managed_codex_projection
sync_claude_code_runtime
sync_runtime_signature
sync_runtime_instructions
opencode_project_subagents_optional
update_chat_bridge_systemd
update_chat_bridge_launchd
reconcile_wordpress_service
reconcile_datamachine_worker_service
refresh_opencode_runtime_signature_phase
installation_profile_write
print_summary

Chat-bridge unit files, the WordPress and worker service reconciliation, and the installation profile left unconverged — because one memory file was stale.

And nothing said so. The run stopped on the last warn line of the composition attempt, so the log reads as though it simply ended: no "Upgrade complete", no Updated:, no Pending:, and nothing stating that eleven phases had been skipped. That is what made the h44 nightly expensive to diagnose — the output ends nowhere near the actual exit point, so the obvious reading is that the failure lies in whatever ran last.

The fix

Capture it the way the same block already captures convergence_run:

regenerate_agents_md || AGENTS_MD_EXIT_STATUS=$?

Run the remaining phases, print the summary, exit non-zero at the end. A stale AGENTS.md is worth failing the job over — that is how the underlying composition bug (Extra-Chill/data-machine#3512) surfaced at all — but it is not worth abandoning service reconciliation halfway through.

print_summary names this case explicitly. With every other phase converged, a non-zero exit would otherwise have no visible cause anywhere in the summary:

Upgrade completed except AGENTS.md — composition failed; see above.

Verification

tests/agents-md-failure-does-not-abort-upgrade.sh extracts the real execute block from upgrade.sh and runs it against stubbed phase functions, so it fails if the capture is dropped no matter how the call is rewritten — rather than asserting on source text, which would pass against a differently-worded regression.

Against the unfixed script it reproduces the live failure exactly — the transcript stops dead at regenerate_agents_md, matching the h44 log:

FAIL: runtime_guidance_sync_managed_codex_projection did not run after the AGENTS.md failure
FAIL: sync_claude_code_runtime did not run after the AGENTS.md failure
... (12 phases)
FAIL: print_summary did not run after the AGENTS.md failure
--- transcript ---
RAN sync_skills
RAN regenerate_agents_md
--- exit status: 1 ---

With the fix:

ok   remaining phases run after an AGENTS.md composition failure
ok   the run still exits non-zero (1)

Registered in the shell.yml matrix; tests/ci-coverage.sh passes. agents-md-backup-retention, agents-md-composition-integration, plugins-only-scope, dead-mechanism and duplicate-mechanism all still pass.

Context

This is the delivery half of the h44 nightly failure. The cause was Extra-Chill/data-machine#3512 (a root-created composition lock the service user could never open); this is why one wedged file took down the whole maintenance job instead of leaving a stale AGENTS.md behind. Worth fixing independently of that one — this turns any future composition fault into a reported failure rather than a silent truncation.