Make the Pi latest-version canary conclude as advisory instead of failed

Severity: medium | Confidence: 0.99 | Effort: S

Where:

• .github/workflows/ci.yml:327-357
• .github/workflows/ci.yml:842-881

Evidence: The ca-pi-latest job is declared continue-on-error: true and omitted from required_results, but its failing steps still produce a failed check run. On PR #313, GitHub reports [WATCH] | [PI ] | Upstream compatibility <runtime: npm latest> with conclusion FAILURE while [GATE ] | [REPO] | Merge readiness succeeds. The canary is nonblocking to branch protection but the PR's CI is visibly red, contrary to the WATCH/advisory contract emitted by the workflow.

Impact: Every upstream incompatibility marks an otherwise merge-ready pull request red, obscures real required failures, and prevents maintainers or automation from treating an all-required-green run as green without special-casing this check.

Recommendation: Keep the latest-Pi probe and its diagnostics, but contain expected incompatibility at step level and always finish the WATCH job successfully after publishing an explicit advisory summary or artifact. Reserve a failed check conclusion for failures in the canary harness itself, not for the upstream compatibility result it is designed to observe.

Acceptance criteria:

• A deliberately incompatible latest-Pi probe records the version and failing contract in the check summary or artifact while the WATCH check concludes success or neutral.
• A canary harness failure such as checkout, install infrastructure, or receipt publication still produces a failed check.
• The merge-readiness job remains independent of the advisory result and a PR with all required checks green has no failed CI check solely because latest Pi is unsupported.