fix(ci): target the failure region when parsing the pin guard from job logs

[joshua-temple]

Problem

The PR Failure Report companion (drift-comment.yaml) parses the action-pins consistency guard (TestActionPinsAnchorCoversManifest / TestWorkflowsConsistentWithActionPins) from a failed job's log so it can print the exact internal/generate/action_pins.yaml remediation (action, want vs got SHA). An intentional-trip validation of the merged companion (#441) showed the remediation was absent: the sticky comment named the failed Unit Tests job but printed no manifest edit, only a generic exit code 123 annotation.

Root cause: parsePinGuard was fed the last 30 lines of the job log. For a Go test failure the guard signature and its want ... got ... rows print in the middle of the log; the trailing lines are post-job git-config and credential cleanup ending at Cleaning up orphan processes. The parser saw no signature, so it produced nothing.

Fix

• Feed the full job log to parsePinGuard so the signature and want/got rows are found wherever they land, rather than a blind trailing slice.
• Add extractFailRegion, which anchors on the first failure signature (--- FAIL, the guard messages) and windows forward, so the displayed log region shows the failing test output instead of the cleanup tail. Falls back to the trailing lines for non-test failures.
• Existing fork-log fencing and the non-pin fallback are unchanged.

Verification

• New node unit test (.github/workflows/__tests__/pin-guard.test.js) extracts the shipped helpers verbatim from the workflow (between sentinels, so no forked copy can drift) and runs them against a real captured failing Unit Tests job log. It asserts the manifest remediation is produced, the display region lands on the failure (not the cleanup tail), and that the prior last-30-lines approach produced nothing. 4/4 pass under node --test.
• actionlint clean on the workflow; node --check clean on the embedded script.

The companion runs only from main on workflow_run, so this local proof stands in for a live run.