Fix nnf_cmd exit code and update submodule pointers

Preserve the exit code of release-all.sh through the pipe in nnf_cmd
by returning PIPESTATUS[0]. Previously, all invocations exited 0 because
the pipe's exit code was that of 'cat', not release-all.sh.

Also advance submodule pointers to their current master HEADs:
- lustre-fs-operator: 7ebec7d -> c59379b (PR #125 update-vendor)
- nnf-dm:             42a3d3a4 -> c959e3b5 (PR #360 update-vendor + others)
- nnf-integration-test: b967cc0 -> 3e52df1 (PR #160 update-vendor + #159)
- nnf-sos:            8749851d -> bcb00b92 (PR #604 update-vendor + others)

Also restore the ONE-command-per-turn rule to release.agent.md and
remove trailing blank lines from RELEASE-PLAN.md.

Signed-off-by: Anthony Floeder <anthony.floeder@hpe.com>

Author: ajfloeder

.github/agents/release.agent.md

@@ -18,6 +18,7 @@ Before starting any release work, read these files completely:
 ## Core Rules
 
 - **ALWAYS wait for explicit user approval before proceeding to the next step.** After every step, state what you did, whether it succeeded, and the evidence. **WAIT for the user.**
+- **ONE command per turn.** Run the command for ONE repo, show the full output, state PASS or FAIL with evidence, then STOP. Do not run the next repo's command until the user explicitly says to proceed. This applies even when the plan shows a `for` loop — execute the loop body manually, one repo per turn.
 - **ALWAYS run commands in a terminal** so the user can see them.
 - **ALWAYS append `2>&1 | cat`** to every `release-all.sh` and `gh` command — no exceptions.
 - **ONE repo at a time.** Execute one phase per repo sequentially. **NEVER parallelize** across repos.

lustre-fs-operator

@@ -102,6 +102,8 @@ Source the release environment helper to auto-compute versions, detect the relea
 source ./setup-release-env.sh -B patch   # or -B minor / -B major
 ```
 
+> **Important:** Never pipe this `source` command (e.g. `source ... | cat`). Piping runs `source` in a subshell, which means the exported variables and function definitions (`nnf_cmd`, etc.) are lost to the calling shell. If you need to capture output, redirect to a file or run without the pipe.
+
 This exports `$PREVIOUS_RELEASE`, `$NNF_RELEASE`, `$RELEASE_TYPE`, and `$RELEASE_REVIEWERS`, and defines helper functions `nnf_cmd`, `nnf_create_pr`, `nnf_add_reviewers`, and `nnf_gh_repo`. Confirm the printed summary with the user before proceeding.
 
 List repos:
@@ -270,8 +272,6 @@ The `-i` flag displays image version changes inline. Use `-d` to display the ful
 
 Check each repo for correct tag, release notes, and artifacts (`manifests.tar` + `manifests-kind.tar` on `nnf-deploy`).
 
-
-
 ---
 
 ### Relevant files

nnf-dm

@@ -78,9 +78,12 @@ fi
 # Usage: nnf_cmd <phase> <repo>
 nnf_cmd() {
     local phase="$1" repo="$2"
-    local args=()
+    local args=() _rc
     [[ "$repo" == "nnf_sos" ]] && args+=("-M")
     ./release-all.sh -B "$RELEASE_TYPE" -P "$phase" -R "$repo" "${args[@]}" 2>&1 | cat
+    # bash uses PIPESTATUS[0]; zsh uses pipestatus[1] (lowercase, 1-indexed)
+    _rc=${PIPESTATUS[0]:-${pipestatus[1]}}
+    return "${_rc:-0}"
 }
 
 # --- Helper: create-pr + capture PR number -----------------------------------