ci: surface gist-badge update failures (no more silent 401)

The test-count badge step ran the gist PATCH with `curl -s -o /dev/null
-w "%{http_code}"` — discarded body, never set a non-zero exit code on
HTTP 4xx / 5xx. When GIST_TOKEN expired the gist returned 401 but CI
stayed green and the badge silently stuck on a stale value (2061
through several releases despite test count growing to 3818).

Switched to `curl --fail-with-body -sS` so:
- Non-2xx responses produce a non-zero exit code (CI fails loudly)
- Response body prints to stderr (so the operator sees the actual
  GitHub error, e.g. "Bad credentials")
- Successful PATCH stays quiet (no progress bar)

Operator action required when this fires: rotate GIST_TOKEN at
https://github.com/settings/tokens (scope: gist) and update the
GIST_TOKEN secret at https://github.com/MakazhanAlpamys/Soup/settings/secrets/actions

Docs-only / CI-only change: no version bump, no soup_cli/ touched.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -56,7 +56,10 @@ jobs:
           print(ts.attrib.get('tests', '0') if ts is not None else root.attrib.get('tests', '0'))
           ")
           echo "Test count: $TESTS"
-          curl -s -o /dev/null -w "%{http_code}" \
+          # --fail-with-body: surface non-2xx (e.g. 401 expired token) as a
+          # CI failure with the response body printed, instead of silently
+          # discarding to /dev/null and leaving the badge stale.
+          curl --fail-with-body -sS \
             -X PATCH \
             -H "Authorization: token ${{ secrets.GIST_TOKEN }}" \
             -d "{\"files\":{\"soup_tests.json\":{\"content\":\"{\\\"schemaVersion\\\":1,\\\"label\\\":\\\"tests\\\",\\\"message\\\":\\\"$TESTS passed\\\",\\\"color\\\":\\\"brightgreen\\\"}\"}}}" \