ci: propagate curl's exit status in the archive canary

`read -r ... < <(curl ...)` returns read's own status and discards curl's.
A transfer that fails after the response headers — a truncated body, exit
18 or 56 — still emits `%{http_code} 200`, so every assertion below it
passed on a fetch that never completed. Raised in review of #2376.

Verified rather than assumed. Simulating curl emitting its -w output and
then exiting 56:

  read -r a b c < <(printf '200 0 https://x/\n'; exit 56)
    -> script continues with status=200, exit 0

  out="$( { printf '200 0 https://x/\n'; exit 56; } )" || rc=$?
    -> rc=56, caught

Switches to command substitution with an explicit `|| rc=$?` capture, so
the status can be inspected before `set -e` acts on it, and parses with a
here-string — which also supplies the trailing newline `read` needs, making
the `\n` in the -w format redundant.

Fifth false-pass path closed in this workflow, and the fourth found in
review. Each one had the same shape: a check that reports success without
having measured the thing it names.

Signed-off-by: Mark Chmarny <mark@chmarny.com>

Author: mchmarny

.github/workflows/dgxc-goproxy-probe.yaml

@@ -164,15 +164,26 @@ jobs:
           auth="$("${GOAUTH}" | grep -i '^Authorization:')"
           [ -n "${auth}" ] || { echo "::error::GOAUTH helper produced no Authorization header"; exit 1; }
 
-          # The trailing newline in -w is load-bearing. `read` returns non-zero
-          # at EOF even when it assigned every variable, so without it `set -e`
-          # kills this step with no output at all — which is exactly how it
-          # failed the first time.
-          read -r status redirects effective < <(
+          # Command substitution with an explicit status capture, not process
+          # substitution. `read < <(...)` returns read's own status and
+          # discards curl's, so a transfer that fails *after* the response
+          # headers — a truncated body, exit 18 or 56 — still emits
+          # `%{http_code} 200` and every assertion below passes on a fetch
+          # that did not complete. Verified: a simulated exit 56 after output
+          # is silently accepted under process substitution and caught here.
+          #
+          # `|| rc=$?` keeps the assignment from tripping `set -e` before the
+          # status can be inspected, and the here-string below supplies the
+          # trailing newline `read` needs to avoid returning non-zero at EOF.
+          rc=0
+          out="$(
             printf 'header = "%s"\nurl = "%s"\n' "${auth}" "${url}" \
               | curl --config - -sSL --max-time 60 -o /dev/null \
-                     -w '%{http_code} %{num_redirects} %{url_effective}\n'
-          )
+                     -w '%{http_code} %{num_redirects} %{url_effective}'
+          )" || rc=$?
+          [ "${rc}" -eq 0 ] \
+            || { echo "::error::curl exited ${rc}; the transfer did not complete"; exit 1; }
+          read -r status redirects effective <<<"${out}"
           echo "status: ${status}"
           echo "redirects: ${redirects}"
           echo "final URL host: $(printf '%s' "${effective}" | sed -E 's#^https?://([^/]+)/.*#\1#')"