ci: capture the Rust step's own output, not just cargo's

The breadcrumb narrowed run 494 to the Rust step, and rust.log did not
exist — so cargo never started. Whatever failed (apt-get, git config, or
docker itself) wrote to the job log, which the actions-log API will not
give us.

The docker run's stdout and stderr now land on the host too, and the step
exits with docker's status.

Co-Authored-By: Claude Opus 5 <[email protected]>

.gitea/workflows/deploy.yml

@@ -114,6 +114,11 @@ jobs:
       - name: Rust tests
         run: |
           echo "2-rust" > /tmp/ci-logs/STEP
+          # The DOCKER RUN's own output, on the host. cargo's log only exists
+          # if cargo runs; run 494 died in this step with no rust.log at all,
+          # which means apt-get, git config or docker itself failed and the
+          # message went only to the job log we cannot read.
+          set +e
           docker run --rm --network host \
             -v "$PWD":/w -w /w \
             -v cm-ci-cargo-registry:/usr/local/cargo/registry \
@@ -149,7 +154,11 @@ jobs:
               set -e
               grep -nE "test result: FAILED|^error(\[|:)|panicked at" /cilog/rust.log | head -40 || true
               tail -40 /cilog/rust.log
-              exit $rc'
+              exit $rc' > /tmp/ci-logs/rust-step.log 2>&1
+          rc=$?
+          set -e
+          tail -60 /tmp/ci-logs/rust-step.log
+          exit $rc
 
       # -v, not just -f. The postgres image declares a VOLUME, so removing the
       # container without it orphans an anonymous data directory EVERY run.