Publication fixture can fail a merge-queue run without saying why #5716

🤖 Generated by the Agentic Engineer

Why

A merge-queue run failed with no stated reason, so nobody can tell whether it is a flake or a defect. Merge-group run 41385643976 failed at 04:02 UTC on 2 November, in "Validate the approved-revisions generator", and evicted #5712. It was the first queue run I found after #5710 raised these fixtures from two to four parallel jobs. One sample is not proof of a link: the #5711 group's batch reported success minutes later.

What is known

test-canonical-publisher-regeneration.sh exited 1 after 157 s. The manifests family passed. The app family ran its first two generator calls and stopped with no message.

From reading the script, not from a reproduction, the steps after that point that can fail silently are the two grep -q 'canonical publisher.*not approved' lines. Both read $test_work/refusal, which is deleted on exit. If the generator is refused for any other reason, the cause is lost.

Smallest useful change

Print the refusal file when that grep does not match, keeping the test's failure result unchanged. The next occurrence then names its cause.

Done when

• A refusal without the expected wording fails the test and prints what the generator said.
• If the failure recurs, its cause is recorded here and fixed, or Reduce CI critical-path time while preserving validation #5495's parallelism is reassessed with that evidence.

Part of #5495