fix(ci): hydrate script fed slugs to python via stdin, colliding with the heredoc program

The hydrate step ran python via `python - <<'PY'`, which reads the PROGRAM
from stdin — so piping the slug list into the same stdin collided: the
interpreter either sees an empty sys.stdin (CI: heredoc wins → hydrated=0,
printf broken pipe → pipefail exit 1) or tries to execute the slugs as
source. Never worked; the conformance workflow's first real runs both died
here. Pass the slug list in a temp file (SLUGFILE) and read that instead of
sys.stdin, keeping the heredoc as the program. Verified end-to-end against a
stub raincloud (under-cap hydrate, over-cap skip, null-size-as-0 all correct).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dfa1

scripts/hydrate-raincloud-corpus.sh

@@ -67,10 +67,18 @@ if [ ${#SLUGS[@]} -eq 0 ]; then
 fi
 
 mkdir -p "$(dirname "$MANIFEST")"
-printf '%s\n' "${SLUGS[@]}" | MAX_MB="$MAX_MB" MANIFEST="$MANIFEST" "$VENV/bin/python" - <<'PY'
+
+# `python - <<'PY'` reads the PROGRAM from stdin, so stdin is unavailable for data:
+# piping the slug list into it would collide with the heredoc (the interpreter would
+# either execute the slugs as source or see an empty sys.stdin). Hand the slugs over
+# in a temp file instead and let the program read that.
+SLUGFILE="$(mktemp)"
+trap 'rm -f "$SLUGFILE"' EXIT
+printf '%s\n' "${SLUGS[@]}" > "$SLUGFILE"
+
+MAX_MB="$MAX_MB" MANIFEST="$MANIFEST" SLUGFILE="$SLUGFILE" "$VENV/bin/python" - <<'PY'
 import json
 import os
-import sys
 from importlib import resources
 
 import raincloud
@@ -85,9 +93,12 @@ sizes = {
     for slug, entry in snapshot["slugs"].items()
 }
 
+with open(os.environ["SLUGFILE"]) as fh:
+    slugs = [line.strip() for line in fh if line.strip()]
+
 hydrated, skipped = 0, 0
 with open(os.environ["MANIFEST"], "w") as manifest:
-    for slug in (line.strip() for line in sys.stdin if line.strip()):
+    for slug in slugs:
         size = sizes.get(slug, 0)
         if max_bytes and size > max_bytes:
             print(f"skip {slug}: {size / 1e6:.0f} MB exceeds --max-mb")