ci: report all workspace tests in hosted CI

[Anand-0037]

Summary

Addresses #195.

Hosted CI stopped at the first failing workspace package, which could hide results from later packages when an unrelated live test failed.

This patch:

• changes the Linux hosted test step to pnpm -r --no-bail test
• keeps local pnpm test behavior unchanged
• documents how to distinguish baseline failures from regressions

#200 already removed the expired Aave quarantine that originally exposed #195. This patch does not change Aave, Kuru, package code, or the live verification workflow.

Verification

Local:

• pnpm build: passed
• pnpm typecheck: passed
• pnpm lint: passed
• env MOSS_SKIP_E2E=1 pnpm -r --no-bail test: passed with all workspaces reporting
• synthetic early failure: later workspaces still ran and the command exited non-zero
• workflow YAML parsing: passed
• git diff --check: passed

Hosted CI:

• lint, build, and typecheck passed
• Aave failed first, but later workspace tests continued to run
• final recursive result: 3 failing workspaces, 18 passing
• the test command still exited non-zero
• windows-offline passed

The live failures are outside this patch. Aave is tracked in #201 and Kuru in #194. The no-bail run also surfaced a Merkl request failure that was previously hidden behind the earlier failure.

No package or lockfile changes.

[nishuzumi]

Reviewed 3fc1162 plus my one-line follow-up. pnpm -r --no-bail test in the Linux job is the right fix for the first-fail bail: the hosted run on this head reported all 21 workspaces (3 failing, 18 passing) instead of stopping at Aave, and the job still exits non-zero. Local pnpm test is unchanged; the CONTRIBUTING note tells contributors how to read a red job whose failing package is not in their diff.

The no-bail run immediately paid for itself: it surfaced that the Merkl live suite fails on the hosted runner with Merkl rewards request failed: fetch failed. That is the egress allowlist, not the adapter — harden-runner blocks api.merkl.xyz, which #187 needed and which the bail had hidden. I pushed api.merkl.xyz:443 into allowed-endpoints on this branch since it is the same file and the same "make hosted CI report the truth" concern.

This closes the bail half of #195. The tripwire half — expiry checks living in a scheduled live-verify run rather than in every PR's gate — is still open there.