fix(ci): surface refresh-baselines HTTP error body and status code (#161)

* fix(ci): surface refresh-baselines HTTP error body and status code

Replace `curl -s -f` (silent + fail-no-body) with explicit HTTP code
capture and response body dump. Workflow has been failing every 6h
with exit 22 (HTTP >=400) but root cause was hidden. Next failure
will print HTTP status + Supabase error message in logs.

* fix(ci): harden refresh-baselines step against curl/HTTP edge cases

Address CodeRabbit review feedback on PR #161:
- Add EXIT trap to clean up mktemp response file
- Capture curl exit code; surface clear error when curl fails before
  producing an HTTP code (DNS, TLS, connection reset)
- Validate http_code is numeric before integer comparison to avoid
  obscure "integer expression expected" failure
- Only dump response body on HTTP >=400 to avoid noisy logs and
  reduce risk of leaking verbose payloads on success

Author: mmmprod

.github/workflows/refresh-baselines.yml

@@ -14,8 +14,28 @@ jobs:
           ANON_KEY: ${{ secrets.SUPABASE_ANON_KEY }}
           SECRET: ${{ secrets.REFRESH_SECRET }}
         run: |
-          curl -s -f -X POST \
+          response=$(mktemp)
+          trap 'rm -f "${response}"' EXIT
+          curl_exit=0
+          http_code=$(curl -sS -X POST \
+            -o "${response}" \
+            -w "%{http_code}" \
             "${FUNCTION_URL}/refresh-baselines" \
             -H "Authorization: Bearer ${ANON_KEY}" \
             -H "x-refresh-secret: ${SECRET}" \
-            -H "Content-Type: application/json"
+            -H "Content-Type: application/json") || curl_exit=$?
+          if [ "${curl_exit}" -ne 0 ]; then
+            echo "curl failed before producing an HTTP response (exit ${curl_exit})"
+            exit 1
+          fi
+          if ! [[ "${http_code}" =~ ^[0-9]+$ ]]; then
+            echo "Invalid HTTP code: ${http_code:-<empty>}"
+            exit 1
+          fi
+          echo "HTTP ${http_code}"
+          if [ "${http_code}" -ge 400 ]; then
+            echo "Response body:"
+            cat "${response}"
+            echo
+            exit 1
+          fi