fix(ci): review fixes — compat errexit + nightly slack run url

- release_compat_e2e was invoked as `|| compat_rc=$?`, which suspends errexit for
  the whole function and its subshell, masking build/install failures (the subshell
  set -e did not restore it). Toggle errexit explicitly instead so a failed build
  surfaces as a non-zero compat result, and correct the misleading comment.
- Forward RUN_ID to the ci3 Run step so the nightly compat-failure Slack alert links
  a real GitHub run URL (on EC2, RUN_ID was a millisecond timestamp).

Author: Adam Domurad

.github/workflows/ci3.yml

@@ -122,6 +122,8 @@ jobs:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           GITHUB_REF_NAME: ${{ github.ref_name }}
           GITHUB_ACTOR: ${{ github.actor }}
+          # Forwarded to EC2 so release_compat_e2e's nightly-failure Slack alert can build a real run URL.
+          RUN_ID: ${{ github.run_id }}
           CI3_INSTANCE_PROFILE_NAME: ${{ secrets.CI3_INSTANCE_PROFILE_NAME }}
           CI3_SECURITY_GROUP_ID: ${{ secrets.CI3_SECURITY_GROUP_ID }}
           AWS_OIDC_ROLE_ARN: ${{ secrets.AWS_OIDC_ROLE_ARN }}

bootstrap.sh

@@ -623,7 +623,8 @@ function release_compat_e2e {
 
   # Build and run the compat test commands in an isolated subshell so the bespoke test settings
   # (no test cache, no fast-fail short-circuit) don't leak into the release build/publish that follows.
-  # set -e is explicit here because this function runs under `||` in ci-release, which suspends it.
+  # set -e re-enables errexit inside this subshell: the caller invokes release_compat_e2e with errexit
+  # disabled (to capture its exit code), so without this a failed build/install would be masked.
   (
     set -e
     export USE_TEST_CACHE=0
@@ -946,8 +947,13 @@ case "$cmd" in
 
     # Backwards-compatibility e2e checks. A failure blocks stable/RC releases, but only warns on
     # nightlies (where compat coverage is observational) so the nightly publish still proceeds.
+    # Toggle errexit explicitly rather than `release_compat_e2e || compat_rc=$?`: calling under `||`
+    # suspends errexit for the whole function (and its subshell), masking build/setup failures there.
     compat_rc=0
-    release_compat_e2e || compat_rc=$?
+    set +e
+    release_compat_e2e
+    compat_rc=$?
+    set -e
     if [ "$compat_rc" -ne 0 ]; then
       if [[ "${REF_NAME:-}" == *-nightly.* ]]; then
         run_url="https://github.com/${GITHUB_REPOSITORY:-AztecProtocol/aztec-packages}/actions/runs/${RUN_ID:-unknown}"