ci: require HTTP 200 from the archive canary

The canary checked redirects and final host but never the response status,
and curl ran without --fail. A 401 or 404 reports zero redirects with an
Artifactory url_effective, so both assertions passed on a response that
carried no archive — the same shape of false pass the canary was added to
close, reintroduced one layer down. Raised in review of #2376.

Captures %{http_code} and requires 200 before the redirect and host checks
run. Verified the rejected path directly: status 404, redirects 0, host
edge.urm.nvidia.com now fails instead of passing.

Asserting the code rather than relying on --fail keeps the error message
specific — it names the status, where --fail under set -e would kill the
step with no diagnostic, which is how the newline bug in d77849f
presented.

Signed-off-by: Mark Chmarny <mark@chmarny.com>

Author: mchmarny

.github/workflows/dgxc-goproxy-probe.yaml

@@ -168,21 +168,28 @@ jobs:
           # at EOF even when it assigned every variable, so without it `set -e`
           # kills this step with no output at all — which is exactly how it
           # failed the first time.
-          read -r redirects effective < <(
+          read -r status redirects effective < <(
             printf 'header = "%s"\nurl = "%s"\n' "${auth}" "${url}" \
               | curl --config - -sSL --max-time 60 -o /dev/null \
-                     -w '%{num_redirects} %{url_effective}\n'
+                     -w '%{http_code} %{num_redirects} %{url_effective}\n'
           )
+          echo "status: ${status}"
           echo "redirects: ${redirects}"
           echo "final URL host: $(printf '%s' "${effective}" | sed -E 's#^https?://([^/]+)/.*#\1#')"
 
+          # Status first. Without it a 401 or 404 also reports zero redirects
+          # from the Artifactory host, so the two checks below would pass on a
+          # response that carried no archive at all — the same shape of false
+          # pass this canary was added to close.
+          [ "${status}" = "200" ] \
+            || { echo "::error::archive probe returned HTTP ${status}, not 200; nothing was served"; exit 1; }
           [ "${redirects}" -eq 0 ] \
             || { echo "::error::Artifactory redirected ${redirects} time(s) to ${effective}"; exit 1; }
           case "${effective}" in
             https://edge.urm.nvidia.com/*) ;;
             *) echo "::error::bytes came from ${effective}, not Artifactory"; exit 1 ;;
           esac
-          echo "OK: Artifactory served the archive directly, no redirect to another origin"
+          echo "OK: Artifactory served the archive directly (HTTP 200, no redirect to another origin)"
 
       # Guards the guard. Both assertions above are satisfied by a job that
       # never fetches anything, which is how the first enforced run passed on a