fix(ci): surface dockhand errors in Build Skill Artifacts step

[JAORMX]

Summary

• The Build skill artifact step in .github/workflows/build-skills.yml captured dockhand's combined output with output=\$(/tmp/dockhand build-skill ... 2>&1) and then echo \"\$output\". Under set -e, a dockhand failure exits the shell on the assignment line before echo runs, so the only signal in the job log is ##[error]Process completed with exit code 1. — the actual dockhand error is never printed.
• This is exactly why we could not diagnose the post-merge failures on feat(skills): package 4 Google Gemini skills #502 and feat(skills): package 3 Neon skills #506 (some matrix cells fail, others succeed; logs are silent either way).
• Stream dockhand output through tee to a tempfile and enable pipefail, so output is visible in real time and a non-zero exit still fails the step.

Behavior

• Success path: unchanged — digest is extracted from the captured log and written to steps.build.outputs.digest.
• Failure path: dockhand's stdout/stderr now appears in the job log, then pipefail + errexit fails the step.
• Empty-digest path preserved via || true on the grep | awk pipeline; downstream steps already gate on digest != ''.

Test plan

• Workflow YAML parses (validated locally).
• Merge, then re-run Build Skill Artifacts via workflow_dispatch (or retrigger the failed runs for feat(skills): package 4 Google Gemini skills #502 / feat(skills): package 3 Neon skills #506) and confirm dockhand error text is visible in the job log.
• Confirm successful builds still write steps.build.outputs.digest and proceed through Cosign + attestation steps.

🤖 Generated with Claude Code

[github-actions]

🛡️ Skill Security Scan Results

⚠️ No skills were scanned in this PR.

[samuv]

🚢