fix(ci): the icarus gate was blind to every test failure (missing pipefail)

[gHashTag]

The required icarus check could not fail on a failing spec

Its loop is:

if ! $T27C icarus-simulate specs/${spec}.t27 | tee /tmp/${spec}.simlog; then

A bash pipeline's exit status is the last command's — tee, which always succeeds. No shell: or defaults: is declared, so GitHub's default bash -e {0} applies without pipefail. t27c correctly exits 1 and prints Error: Icarus simulation reported test/bench failures, but the pipe swallowed it and the gate reported green.

Demonstrated: injecting a failing assertion into crc16 and running the exact CI construct yields STATUS=0 — a false green. With set -o pipefail the same input yields STATUS=1.

So the gate effectively only ran the bench budgets and the wave-55 coverage guard. Every "N specs pass under icarus" claim rested on local verification, not on this check. This is the broken-ruler failure mode: the instrument meant to measure correctness could not report incorrectness.

Fixes both pipe-swallowing sites

• gft-verilog-kat.yml — the icarus simulate loop (the critical one)
• spec-drift-guard.yml — the typecheck | grep -q loop, same class

The typecheck change was verified safe first: across all 107 specs the t27c exit code and the grep verdict never diverge, so pipefail cannot introduce a false positive there.

Verified both directions

• Negative: an injected failing assertion is now detected (STATUS=1, previously 0)
• Positive: the healthy 107-spec corpus still simulates green under pipefail (STATUS=0) — no false positives

🤖 Generated with Claude Code