executor: the ERR trap reports a failing command, not a propagating status (#729)

[berrym]

Closes #729.

The rule

The ERR pseudo-signal notifies that a command failed. lush fired on any non-zero status that reached a statement walker -- a different thing -- and the gap showed in four shapes.

1. Propagation was re-reported (the filed defect)

$ lush -c "trap 'echo T' ERR; for i in 1; do for j in 1; do false; done; done"
T
T
T                # bash, zsh: one T

The count tracked nesting depth rather than failures. Note the rule is per failing command, not per compound status: for i in 1 2; do false; true; done notifies twice in all three shells even though the loop succeeds. lush already had that right, which is what pins the semantics.

2. Tested positions were reported (found while fixing #1)

A command whose failure is being tested is not an error -- the shell is asking whether it succeeds. lush reported three of the four tested forms:

	lush before	bash	zsh
false && true	T	-	-
! true	T	-	-
if { false; }; then :; fi	T	-	-
if false; then :; fi	-	-	-

Tested-ness is inherited, which is why the fix is a depth rather than a flag: in true && false || true the inner && sits in the tested left position of the ||, so its final operand is not final overall.

3 and 4. The same root, in the opposite direction

• A case arm ran its statements through no firing walker at all: case x in x) false; false;; esac notified once, where bash notifies twice.
• A function body fired once for its aggregate result without asking what produced it, so with set -E a failing loop body notified three times. Without errtrace fire_err_trap suppresses in-function notifications, which is exactly why that one looked correct.

The fix

One rule at every site: report a failure where it originates, never where a status passes through, and never while testing.

• g_err_tested_depth marks tested evaluation (conditions, the operand of !, non-final &&/|| operands) and gates every firing site.
• err_trap_status_is_propagated names the constructs that report their own inner failures.
• A subshell, a function call, select, time, a plain command and a pipeline are deliberately not listed -- their status originates where the walker sees it.

bash and zsh agree on every shape, and this is lush's own model of what the trap means, so it is mode-invariant and gates nothing.

Verification

• 55-shape differential against bash: 55/55 identical, covering all four defect families, both set -E and set -e, pipelines and nesting.
• tests/integration/test_err_trap_per_failure.c -- 41 checks, and 23 fail against the parent build with a control proving the binaries differ.
• Full suite 193/193. ASan 65/65; the new test 1/1 under ASan.
• errexit ordering preserved: the notification still precedes the abort, and a tested failure still does not abort (set -e; false || true reaches the next command).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!