[helly25]

--keep-tmpdir=failure now preserves diagnostics after hook failures, aborted runs, invalid runner settings, and report-writing errors, including runner failures handled by the caller. Successful runs still clean up; never and always keep their explicit policies.

AG;DR

• Classify retention using the captured process exit status, persistent runner failure state, hook/case failure flags, and durable assertion state. Preserve the original nonzero process status and the existing runner/report error semantics.
• Record unsuccessful runner returns so a conditional caller handling the status does not delete diagnostic artifacts. This also works with XML disabled.
• Track ownership only after successful scratch creation. If creation fails, cleanup cannot remove an inherited BASHTEST_TMPDIR or the caller's TEST_TMPDIR.
• Add Python regressions covering all modes with/without reports, success, ordinary failure, hooks, exit 0/42, an unset variable, TERM/143, invalid/no-match filters, handled runner errors, failed report writes, and failed scratch creation with a caller-owned sentinel.
• Add portable Bash retention fixtures exercised through the macro and plain sh_test; each report-write case uses a fresh destination so it verifies a real write error. Document the retention policy and Bazel sandbox boundary.

Validation on published head 438c9e5eb653521225d41258edd1a6db8655dd3d: focused pre-commit (all 73 Python tests), bazel test //..., bazel test --enable_runfiles=no //..., and external consumer integration. Local validation uses macOS Bash 3.2; Windows-only runtime coverage is incompatible locally. All checks passed in CI run 40217094526, including Linux, macOS, and managed Windows integration.

Dependencies: PR #65 is merged and its main run 40216264168 passed every check. No open PR dependencies. This is the scratch-retention part of the sequential diagnostics work; golden diffs, call sites, live output, and interruption diagnostics remain for later focused PRs after this one merges. Catchable signals retain artifacts; SIGKILL and Bazel sandbox removal remain outside the runner's cleanup control.