feat(standards): name what failed, not just that something did

[twistedmelonman]

What

A failed standards check now says which linter failed and what it found. Before this, the check printed "shellcheck found problems" and then "N linter(s) failed". Neither line named the rule or the file.

standards/run-standards.sh keeps a copy of each linter's output as it streams. When a linter fails, the script:

1. Adds the first 20 lines of that linter's findings to its ::error title=<linter>:: annotation. The check's annotation list then shows the rule and the file.
2. Ends with ::error::standards-check failed: shellcheck, markdownlint (it lists every linter that failed).
3. When GITHUB_STEP_SUMMARY is set, writes each failed linter's output to the run summary, up to 200 lines each. A clean run writes nothing there.

Exit codes and the streamed log are unchanged.

Tests

New cases in tests/test-run-standards.sh. The first three fail on main (known-bad):

• final error line names the failed linter
• per-linter annotation carries the finding (SC2086)
• step summary names the failed linter and its finding
• clean run writes no failure section to the step summary (a guard, so a green run never lists "failures")

bash tests/run-tests.sh: 21 passed, 0 failed. shellcheck -S info is clean.

The tag stays where it is

Fleet callers pin @standards-check-v1, and the workflow checks out standards/ at job.workflow_sha. So until that tag moves, callers keep running the old script. This PR changes main only. Retagging standards-check-v1 is a separate decision for a human. This PR does not move it.

self-standards-check.yml calls the workflow locally, so this PR's own CI runs the new script.

What's left

The symptom in dev-env#113 is gpush's line CI failed (Standards Check: failure), which comes from dotfiles/bash/gpush-wrapper.sh. This PR doesn't touch gpush. For gpush to show the findings, it would need to print the failing run's annotations or its URL. That is a separate dotfiles change. So this PR advances the issue but doesn't close it.

Advances smartwatermelon/dev-env#113

[claude]

The PR replaces the simple failures counter and _fail helper with a failed[] array, a _lint wrapper that captures linter output via tee, and richer annotation/summary output.

No BLOCK criteria are present:

• The _lint pipeline correctly relies on pipefail (documented in the comment at the change site) — linter failure propagates through the pipeline to the if branch.
• config_dir paths passed to linters inside the cd "${repo}" subshell are absolute (they were already used inside subshells for every other linter before this PR), so the node-floor invocation change in working directory is safe.
• _annotation_escape handles %, CR, LF before inserting linter output into a workflow command; linter names in title= are hardcoded strings, not user-controlled.
• out_dir is properly cleaned up via trap ... EXIT.
• Exit logic ((${#failed[@]} > 0)) is a correct replacement for ((failures > 0)).

VERDICT: PASS