fix(agent-runtime): the OPA step fails at the command that fails, and says why

[beyondnetPeru]

Pull Request Summary

The agent-runtime image build still fails in CI after #672, and the reason I cannot name the cause is the defect this PR fixes: the step reports the wrong error, three commands late.

CI shows:

0.459 OK: 15.9 MiB in 27 packages
1.154 mv: can't rename '/tmp/opa': No such file or directory

Between those two lines there is no output from curl and none from node — not even an error, despite -S, which exists to print them. Neither the download failing nor the test -s guard after it aborted the run. A ; chain that should have stopped and did not turns every possible failure into the same misleading message.

What changes

The step is an && chain instead of set -eu with ;, so any failure stops at that command, with that command's own message. Plus set -x to trace, the resolved pin and URL echoed, test -n to refuse an empty version, and ls -l to show what was actually downloaded before anything is moved.

What this does NOT claim

It does not claim to fix the root cause. It cannot be reproduced here — the image builds clean locally on arm64 and, with --no-cache, on linux/amd64:

+ echo 'OPA pin resuelto: 1.19.0'
+ curl -fsS --retry 3 --retry-connrefused -L -o /tmp/opa https://openpolicyagent.org/downloads/v1.19.0/opa_linux_amd64_static
-rw-r--r--  1 root root 60526763 Sep  1 14:49 /tmp/opa
Version: 1.19.0

Whatever differs lives in the runner, and until now the build was incapable of saying what. Guessing at a cause I cannot observe would repeat the mistake that started this: shipping the first version while stating the image was unverified. This makes the next CI run answer the question instead.

Before you submit

• Sign-off (DCO): the commit carries Signed-off-by.
• Conventional Commits: title and commit follow the convention.
• Agnosticism: no new dependency.
• Bilingual: no documents touched.

Linked ADRs / Issues

• Follows fix(agent-runtime): the OPA download follows its redirect instead of silently writing nothing #672, which replaced BusyBox wget with curl and was necessary but not sufficient
• Related: GT-591 (the OPA pin remains the single owner of the version)

What the reviewer should know

Build & Push Services (GHCR) still does not gate a pull request here, so this PR's own green checks will not prove the image builds — the same gap recorded in #672 and #673. The evidence that this step works is the local --no-cache linux/amd64 build quoted above; the evidence about the runner will arrive on the next push to a branch that job watches.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

📊 Bilingual Coverage Impact

PR Changes

• Paired EN/ES files modified: 0
• New EN files needing ES translation: 0

Repository Coverage

Metric	Value
Total EN files	527
Total ES files	497
Paired files	0
Coverage	0%

✅ Good: All EN changes have ES counterparts.

---

Generated by GitHub Actions