DEMO ONLY: wire faultcat-explore into multi-node-tests CI

[UtkarshBhatthere]

⚠️ Do NOT merge. This PR exists to exercise canonical/faultcat PR #8 (feat/explore-mode) end-to-end against a real failing microceph CI job. Both demo changes are tagged FAULTCAT-DEMO so they can be ripped out cleanly. The PR is opened as a draft to make the do-not-merge status visible.

What this PR does

1. Disables the "Add 2 OSDs" step in the multi-node-tests job with if: false. The downstream "Test 3 osds present" / "Test crush rules" steps then fail naturally on the missing setup — this is a real diagnostics_gap shape: state that a later step expects was never set up by an earlier step.

2. Adds a new step right after the existing "Print logs for failure" step:

   - name: FAULTCAT-DEMO faultcat explore
     if: failure()
     uses: canonical/faultcat/.github/actions/faultcat-explore@feat/explore-mode
     with:
       hints: microceph,lxd
       openrouter-api-key: \${{ secrets.OPENROUTER_API_KEY }}
       artifact-name: faultcat-probe-multi-node
       fail-on-explore-error: "false"

   The composite action installs @earendil-works/pi-coding-agent, faultcat, drives Pi (fast tier, DeepSeek V3 via OpenRouter) to inspect the live failed multi-node test environment read-only, validates the output against the same evidence_bundle.v1 / findings.v1 / suggestions.v1 schemas as faultcat M1, scrubs secrets from the entire output tree, and uploads it as a faultcat-probe-multi-node artifact.

What I want to learn from this CI run

• Does the composite action install cleanly on the ubuntu-22.04 runner used by multi-node-tests?
• Does Pi correctly identify the missing-OSDs cause from live microceph status / ceph -s / snap.microceph.osd logs, or does it get distracted?
• Is the resulting artifact actually safe to publish on the public repo (scrubber output looks clean)?
• Are the three baseline skills (microceph, lxd, _default) tight enough that Pi stays focused, or does it bloat?

Prerequisite

OPENROUTER_API_KEY needs to be set as a repo secret in canonical/microceph. The action reads \${{ secrets.OPENROUTER_API_KEY }} — if the secret is missing, the action will run but Pi will return empty content (no fallback model in this first cut). I have not added that secret; would appreciate you doing so before kicking the workflow, or letting me know and I'll keep the PR in draft until it's in place.

When this PR is no longer needed

After the explore action has been observed working over a few real CI failures, a follow-up PR can add the if: failure() step into more (or all) integration test jobs as a permanent hook. This PR's role ends as soon as we have evidence the action behaves correctly.

Test plan

• CI fails as expected in the "Test 3 osds present" step (missing OSDs)
• The FAULTCAT-DEMO faultcat explore step runs to completion (does not fail the job either way thanks to fail-on-explore-error: false)
• faultcat-probe-multi-node artifact appears on the workflow run
• Downloaded artifact contains a scrubbed evidence.yaml, findings.yaml, suggestions.yaml whose content reflects the missing-OSDs failure shape

🤖 Generated with Claude Code