ci: comment survives a missing baseline, picks the right attempt

Review fixes for the comment workflow. Artifacts are downloaded by name
for the exact attempt that finished, and for the baseline run's latest
attempt, since a rerun keeps earlier attempts' artifacts under the same
run. Every lookup prints nothing instead of failing, so no quattro
baseline yet, an expired one, or a missing boot file shows as "–"
rather than ending the script under set -e before any comment. The
install test's own marker step takes ownership of test-runs first,
which the harness created as root inside its container.

.github/workflows/install-test-comment.yml

@@ -27,12 +27,19 @@ jobs:
       HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
       CONCLUSION: ${{ github.event.workflow_run.conclusion }}
     steps:
+      # A rerun keeps earlier attempts' artifacts under the same run, so take
+      # exactly the attempt that finished (and the baseline's latest attempt).
       - name: Fetch this run's numbers and quattro's latest
+        env:
+          ATTEMPT: ${{ github.event.workflow_run.run_attempt }}
         run: |
-          gh run download "$RUN_ID" -R "$REPO" -D pr || true
+          gh run download "$RUN_ID" -R "$REPO" -n "install-test-$RUN_ID-$ATTEMPT" -D pr || true
           base=$(gh run list -R "$REPO" --workflow install-test.yml --branch quattro --event push \
             --status success -L 1 --json databaseId -q '.[0].databaseId')
-          if [ -n "$base" ]; then gh run download "$base" -R "$REPO" -D base || true; fi
+          if [ -n "$base" ]; then
+            base_attempt=$(gh api "repos/$REPO/actions/runs/$base" -q .run_attempt)
+            gh run download "$base" -R "$REPO" -n "install-test-$base-$base_attempt" -D base || true
+          fi
 
       - name: Comment on the pull request
         run: |
@@ -41,18 +48,21 @@ jobs:
 
           # The number comes from the pull request's own run, so trust it only
           # when that pull request's head is the commit this run tested.
-          pr=$(find pr -name pr-number -exec cat {} + 2>/dev/null | head -1 | tr -dc 0-9)
+          pr=$({ find pr -name pr-number -exec cat {} + 2>/dev/null || true; } | head -1 | tr -dc 0-9)
           [ -n "$pr" ] || { echo "No pull request number in the artifact"; exit 0; }
           [ "$(gh api "repos/$REPO/pulls/$pr" -q .head.sha)" = "$HEAD_SHA" ] ||
             { echo "PR #$pr has moved past $HEAD_SHA; not commenting"; exit 0; }
 
-          timing() { find "$1" -name omarchy-install-timing.json 2>/dev/null | head -1; }
-          install_s() { [ -n "$1" ] && jq -r '.finished_at - .started_at' "$1" 2>/dev/null; }
+          # Every lookup prints nothing rather than failing, so a missing baseline (none
+          # yet, or expired) shows as "–" instead of ending the script under set -e.
+          timing() { { find "$1" -name omarchy-install-timing.json 2>/dev/null || true; } | head -1; }
+          install_s() { [ -n "$1" ] || return 0; jq -r '.finished_at - .started_at' "$1" 2>/dev/null || true; }
           # "Startup finished in … = 1min 2.3s" or "= 12.104s" -> seconds
           boot_s() {
             local f
-            f=$(find "$1" -path "$2" 2>/dev/null | head -1)
-            [ -n "$f" ] && head -1 "$f" | sed -n 's/.*= *//p' |
+            f=$({ find "$1" -path "$2" 2>/dev/null || true; } | head -1)
+            [ -n "$f" ] || return 0
+            head -1 "$f" | sed -n 's/.*= *//p' |
               awk '{t=0; for (i=1;i<=NF;i++) { if ($i ~ /min$/) t+=60*$i; else if ($i ~ /ms$/) t+=$i/1000; else t+=$i } printf "%.3f", t}'
           }
           cell() { [ -n "$1" ] && awk -v x="$1" 'BEGIN{printf "%.1f s", x}' || echo "–"; }

.github/workflows/install-test.yml

@@ -89,7 +89,11 @@ jobs:
       # it needs the PR number, which a workflow_run event omits for forks.
       - name: Record the pull request
         if: always() && github.event_name == 'pull_request'
-        run: mkdir -p test-runs && echo "${{ github.event.pull_request.number }}" > test-runs/pr-number
+        run: |
+          # The harness ran as root in its container and created test-runs.
+          mkdir -p test-runs
+          sudo chown "$(id -u):$(id -g)" test-runs
+          echo "${{ github.event.pull_request.number }}" > test-runs/pr-number
 
       - name: Upload test artifacts
         if: always()