fix(migration): phase 122 workflow parse crash + executor false-pass detection

[kjgbot]

Summary

Two bugs caught the hard way while trying to run phase 122 on 2026-04-23. Either alone would have stopped us; both together silently committed empty (but wrong) work to a HIGH-risk production phase.

Bug 1: phase 122 workflow crashes at parse time

`workflows/122-cloud-cutover-phase3b.ts:133` has this inside a JS template literal:

```
for i in $(seq 1 90); do ... echo "soak: ${i}/90 min"; done
```

Node's template-literal interpolation eats `${i}` at module-load time, but `i` is a shell loop variable — not a JS one — so the import throws `ReferenceError: i is not defined` before the workflow runtime starts.

Fix: escape the shell interpolation so `\\${i}` reaches the shell verbatim.

Bug 2: executor reports success for a parse-time crash

`scripts/run-rs256-migration.sh:261` already scans for `[run:failed]` / `[workflow] FAILED:` / `: failed$`. Those markers are emitted by the agent-relay workflow runtime — so a parse-time crash (bug #1) slips past them:

1. Node prints the stack trace to stderr
2. agent-relay's `runScriptFile` wrapper swallows the exit code to 0
3. The executor sees no failure marker, reports "✓ workflow passed"
4. `git add -A && git commit` picks up whatever unrelated files were in the working tree
5. PR opens with garbage diff

Fix: add Node error names (`ReferenceError`, `TypeError`, `SyntaxError`, `RangeError`) as an additional detection pattern.

Not in this PR but related

• The `git add -A` in `commit_phase_changes` (`run-rs256-migration.sh:136`) grabs any uncommitted file in the working tree, not just files the workflow produced. Worth a follow-up to scope commits to known-output paths. Non-blocking.
• Migration state file (`.rs256-migration-state.json`) was locally updated with a false `122: passed` entry from the bad run. That's a local working-copy artifact, not committed.

Test plan

• Parse check: `node --experimental-strip-types workflows/122-cloud-cutover-phase3b.ts` loads past line 133 without the ReferenceError.
• Executor detection: a workflow that throws at import time now exits non-zero from the master script and does not push a PR.
• CI passes.
• Phase 122 runs end-to-end against a preview stage.

🤖 Generated with Claude Code