fix(ops): preserve diagnostic SSH failures

Co-Authored-By: Codex <noreply@openai.com>

Author: Pigbibi

.github/workflows/diagnose.yml

@@ -248,5 +248,7 @@ jobs:
           '
           }
 
+          # Keep SSH/authentication failures visible even though output is filtered.
+          set -o pipefail
           gcloud compute ssh "${REMOTE_TARGET}" "${SSH_FLAGS[@]}" --command "${REMOTE_DIAG_COMMAND}" 2>&1 \
             | redact_diagnostics

tests/test_workflow_shared_config.sh

@@ -161,6 +161,7 @@ grep -Fq 'shell: python3 {0}' "$diagnose_workflow_file"
 ! grep -Fxq '        shell: python3' "$diagnose_workflow_file"
 grep -Fq 'redact_diagnostics()' "$diagnose_workflow_file"
 grep -Fq 'sensitive_assignment_pattern.sub(r"\1\2<REDACTED>\n", line)' "$diagnose_workflow_file"
+grep -Fq 'set -o pipefail' "$diagnose_workflow_file"
 grep -Fq '| redact_diagnostics' "$diagnose_workflow_file"
 ! grep -Fq 'actions/checkout' "$diagnose_workflow_file"
 ! grep -R -Fxq '        shell: python3' "$repo_dir/.github/workflows"