ci(molecule): surface scenario failure text via summary and artifact

[sbaerlocher]

Summary

• A failed molecule scenario was undiagnosable through the GitHub API: raw job logs live behind a blob endpoint that returns 403, leaving only Process completed with exit code 2. in the check-run annotation. The scenario output is now piped through tee into $RUNNER_TEMP, feeding two surfaces the API does serve — the last 200 lines in the job summary, and the full log as an artifact (molecule-log-<driver>-<scenario>, 7 days).
• set -euo pipefail and 2>&1 are load-bearing here: without the first the exit code becomes tee's and every red run reports green, without the second the file omits the very text it exists for. A pipefail-guard job in self-pull-request.yml asserts both against a command that is guaranteed to fail.
• Documented in workflows/README.md under the molecule section, including the gh run download invocation.

Test plan

• Pipe probe: exit code survives tee (exit=2) and stderr lands in the file
• Negative probe: with pipefail absent from both set statements the guard's assertion fires (exit=1, SHOULD-NOT-REACH unreached); with 2>&1 dropped the stderr assertion fires
• Summary tail over a 300-line file contains line 300 and not line 100; empty file and unset variable both produce no disclosure block
• shellcheck -s bash clean on every extracted run: body in both workflows
• YAML asserts: upload step is last in the molecule job with the expected fields; job list is ['lint','review','code-scan','pipefail-guard']
• CI green (actionlint is not installed locally and remains a CI-only gate)