fix(ci): recipe-ci wrapper — capture harness rc, clear traps before exit (green runs no longer exit 1)

The drone exec runner's step shell is set -e. On a NORMAL harness exit the EXIT trap still
fired and its kill of the already-exited process group failed with ESRCH, poisoning the
script's exit status: build 269 (plausible#3) ran fully GREEN (all tiers pass, level=4) but
the step exited 1. Reproduced minimally with sh -e and bash -e on the host; the fixed wrapper
verified for all three paths: green rc=0, red rc=7 (propagated), TERM-to-shell -> child gets
TERM and wrapper exits 143. Cancel forwarding semantics unchanged.

.drone.yml

@@ -75,9 +75,15 @@ steps:
       # forward a drone cancel (TERM to this step shell) to the WHOLE group, so the harness's
       # SIGTERM handler runs its teardown funnel instead of being leaked (the exec runner kills
       # only the step shell, not the tree). PDEATHSIG inside the harness backstops the case where
-      # this shell dies without the trap firing. `wait` propagates the harness exit code.
+      # this shell dies without the trap firing. The harness exit code is captured explicitly and
+      # the traps cleared before exiting: the runner shell is `set -e`, and an EXIT-trap kill of
+      # the already-gone process group returns ESRCH, which otherwise poisons a GREEN run's exit
+      # status to 1 (observed live, build 269: all tiers pass, step exit 1).
       - |
         setsid cc-ci-run runner/run_recipe_ci.py &
         PID=$!
-        trap 'kill -TERM -- "-$PID" 2>/dev/null' TERM EXIT
-        wait "$PID"
+        trap 'kill -TERM -- "-$PID" 2>/dev/null || true' TERM EXIT
+        rc=0
+        wait "$PID" || rc=$?
+        trap - TERM EXIT
+        exit "$rc"