fix: don't mask test-install exit codes through tee

The Makefile let failures slip through silently when the caller piped
output: `make test-install 2>&1 | tee log` returned 0 even when the
inner build or VM run failed, because tee's zero exit masked the
pipeline. This happened today during an ISO rebuild — the first
attempt failed on corrupted pacman cache but the task notification
reported exit 0.

Two changes:

1. Set the recipe shell flags to enable pipefail (`SHELL := /bin/bash`
   + `.SHELLFLAGS := -o pipefail -c`). Any intra-recipe pipeline now
   propagates the first non-zero exit instead of the last. Safe to
   add — no existing recipe uses intra-recipe pipes today.

2. Bake tee into the test-install recipe itself. Output writes to
   `test-logs/make-test-install-YYYY-MM-DD-HHMM.log` so callers never
   need to pipe through tee externally. With SHELLFLAGS pipefail in
   place, the test script's exit code propagates through the baked-in
   tee back to the caller cleanly.

Verified with a repro: a recipe shaped like `failing-cmd | tee log`
returns non-zero; the 71-test bats suite still passes.

1 files changed, 14 insertions, 1 deletions

diff --git a/Makefile b/Makefile
index bf0ea2f..56c0efd 100644
--- a/Makefile
+++ b/Makefile
@@ -20,6 +20,12 @@
 #
 # Test configurations are in scripts/test-configs/
 
+# Recipe shell uses pipefail so intra-recipe pipelines (e.g. the baked-in
+# tee on test-install) propagate the first non-zero exit instead of the
+# last. Without this, `cmd | tee log` would mask cmd's failure.
+SHELL := /bin/bash
+.SHELLFLAGS := -o pipefail -c
+
 .PHONY: test test-install test-vm test-multi test-multi3 test-boot test-clean build release clean distclean lint bats
 
 # Lint all bash scripts
@@ -41,9 +47,16 @@ build:
 	sudo ./build.sh
 
 # Integration tests (runs VMs, slow)
+# tee is baked into the recipe so output is always captured to a
+# timestamped log and callers never need to remember `set -o pipefail`
+# before `make test-install 2>&1 | tee ...` — the recipe's SHELLFLAGS
+# propagates the test script's exit code through the pipe to tee.
 test-install: build
 	@echo "==> Running install tests..."
-	./scripts/test-install.sh
+	@mkdir -p test-logs
+	@logfile="test-logs/make-test-install-$$(date +%Y-%m-%d-%H%M).log"; \
+	 echo "==> Log: $$logfile"; \
+	 ./scripts/test-install.sh 2>&1 | tee "$$logfile"
 
 # All fast tests (lint + bats — VM integration tests via test-install)
 test: lint bats