fix(dependabot): report why a PR read failed, not just that it did

[twistedmelonman]

What happened

The first real digest run failed, and the error message made it undiagnosable:

collect.sh: nightowlstudiollc/kebab-tax-netlify#280: could not read PR detail
run-digest.sh: collection failed for nightowlstudiollc; not publishing a partial digest

That is all it said. The refusal was correct — a partial survey is the one
output this tool must never produce — but "could not read" gave nothing to act
on, and the cause is not reproducible locally: a personal login reads that repo
and that PR over GraphQL without trouble.

The defect

2>/dev/null on the GraphQL call discarded the reason, and the response body's
errors array was never inspected. GraphQL uses both channels — transport
failures go to stderr, while query-level errors (FORBIDDEN, NOT_FOUND,
RATE_LIMITED) come back in the body with HTTP 200 and exit 0. Both now
surface.

Review caught a real bug in the fix

The adversarial reviewer flagged the error formatter itself:

.errors | map(.type // "?" + ": " + (.message // "?"))

+ binds tighter than // in jq, so that parses as .type // ("?: " + .message)
and prints a bare FORBIDDEN — dropping the message, which is the entire
payload this change exists to print. Confirmed by measurement, not by reading:

buggy: FORBIDDEN
fixed: FORBIDDEN: Resource not accessible by integration

tests/test-render.sh now extracts the formatter from collect.sh and runs it
against a real error body. Validated against the known-bad form, where it fails
with the error formatter dropped part of the error: 'FORBIDDEN'.

What this does not do

It does not fix the underlying access problem, because that problem is not yet
identified. It makes the next run say what the problem is. The three tokens
were all created the same way against all repositories, and the failing repo is
indistinguishable from the two that succeeded — same owner, private, not a
fork, not archived — so the answer has to come from GitHub's own error text.

Advances #120.

https://claude.ai/code/session_01ESsw699T54JHARkQXrdL3o

[claude]

Reviewed against BLOCK criteria (bugs, reliability regressions, security vulnerabilities, missing error handling, data loss).

Temp file lifecycle is correct: created once per loop iteration, cleaned up in both error path (before exit 1) and success path. GraphQL error formatter is properly parenthesized to preserve both type and message. New test validates the formatter against real error data.

No BLOCK-level issues found.

VERDICT: PASS