fix(bench): fail bootstrap loudly and stop recording unusable versions

[bryantbiggs]

Three paths in the bootstrap made a failure invisible, and unpinning the tools made hitting them likelier by moving the trigger from an operator editing a pin to an upstream push. Nothing waits on cloud-init, so terraform apply reports success either way and the failure surfaces much later as a missing binary.

The rustup install was the worst of them. su -c 'curl … | sh -s' returns the pipeline's last status, pipefail does not cross the su boundary, and the installer exits zero on the EOF a failed curl feeds it. So the fetch could fail and the retry would report success on the first attempt, having installed nothing. Measured: exit 0 without pipefail, exit 6 with it. It is also the one failure that escaped the downstream guard, because the ocync clone needs no Rust and still succeeds, so bench-remote's [ ! -d ~/ocync ] check passes.

The build block ran without set -e. Only the final command's status escapes a multi-command su -c, so a failed cargo build was masked by the cp after it, and bench-proxy can link even when the ocync crate fails. Separately, every verification line was a command substitution inside an echo argument, which yields echo's status, so no sanity check in the script could fail it. Those are assignments now.

Every network fetch retries, including the dnf calls a cold instance hits first, which previously had none because the helper was defined below them. The final attempt no longer claims it is retrying.

The clone no longer removes an existing checkout. I introduced that in #118 for retry idempotency, and it was wrong: that path holds the git-tracked run-record archive, and re-running the bootstrap through cloud-init clean is a normal thing to do. It clones to a scratch path and moves it into place instead.

On the recording side: a binary built from a working tree stamps (devel), which names no release, so it is no longer read as a version. Every path that ends in a recorded unknown now says why, and says which fallback it took rather than asserting an outcome it does not control — the previous warning claimed Recording "unknown" even where the caller went on to record a real version. The bootstrap no longer parses build info in awk, which duplicated the Rust parser and disagreed with it on exactly the (devel) case the new rule exists for.

One pre-existing bug in the same area: check_tool probed ocync through PATH while run_tool executes target/release/ocync, and the probe ran before the build. On a direct cargo xtask bench that records the release installed at instance creation, potentially months old, against numbers produced by freshly built HEAD. The build now happens first and both resolve the same way.

CI is the gate. Locally cargo fmt, clippy -D warnings, check --no-default-features --features non-fips, cargo deny, terraform fmt, terraform validate, bash -n and 151 xtask tests pass. The ocync-distribution container tests fail on my machine on container startup and this diff cannot reach that crate.