forgetest-ci: the undefined-name step fails on a pyflakes status other than 0 or 1

The step captured the pyflakes run with `|| true`, because pyflakes
exits 1 for any message, and judged the capture alone: "undefined
name" or "Traceback". A run that ended abnormally with no traceback
passed the step with nothing checked: a run killed by a signal, a usage
error (exit 2), or a working directory where the capture cannot be
written (grep then reads no file, and the `if` is false).

The capture is now `{ python -B -m pyflakes forgetest tests || test $?
-eq 1; } > pyflakes.txt 2>&1`. The two normal statuses of pyflakes, 0
and 1, go on to the grep; any other status fails the step under
bash -e, and so does a redirect that fails. The grep stays the gate
for an undefined name and for a Traceback. A comment above the run
block says so.

Proof: the step body, read from this workflow and, as the control,
from the workflow before this change, run under bash -e over the
forgetest tree on Ubuntu 24.04 with python 3.12 and pyflakes 4.0.3
(the install line left out: the interpreter on PATH is a shim or a
venv). Both bodies: the tree as it is exits 0; an undefined name
planted, pyflakes missing, and a pyflakes that raises each exit 1. A
pyflakes killed by SIGKILL, one ended by SIGTERM, one that exits 2,
and a working directory that cannot be written: the former body exits
0 each time, this one exits 1. PyYAML reads the run text of the step
as written.

Acceptance: none; CI only. .github/ is outside meta-forgefirm and
every covers map.

.github/workflows/forgetest-ci.yml

@@ -143,10 +143,13 @@ jobs:
 
       - name: No undefined names (the live drills never execute on the host)
         working-directory: forgefirm/forgetest
+        # pyflakes exits 1 for any message, unused imports included, so the
+        # grep is the gate; any other status (a signal, a usage error) or a
+        # capture that cannot be written fails the step.
         run: |
           python -m pip install pyflakes
           python -B -m pyflakes --version
-          python -B -m pyflakes forgetest tests > pyflakes.txt 2>&1 || true
+          { python -B -m pyflakes forgetest tests || test $? -eq 1; } > pyflakes.txt 2>&1
           if grep -E "undefined name|Traceback" pyflakes.txt; then exit 1; fi
 
       - name: Shared UI files match forgectrl at its pinned revision