fix(init-corpus): exempt download_and_verify from set -e errexit

The fallback-on-drift CI job caught a real bug: under set -euo pipefail,
a bare non-zero function return triggers errexit BEFORE the next line
can capture $?. The primary→mirror fallback path therefore never ran:
the script exited on the first sha256 mismatch instead of falling
through to the WARNING + mirror retry.

Fix: wrap both download_and_verify calls in `if func; then rc=0;
else rc=$?; fi`. The `if` construct exempts the command from
errexit, so we can actually read the return code.

Reproduced locally with the same technique the workflow uses: local
python3 -m http.server serving drifted bytes + jq-patched manifest.
Before the fix: only the first fixture ran and the WARNING line was
missing. After the fix: all 3 fixtures fell through cleanly, both
WARNING lines fired, and the mirror provided matching bytes.

Root cause of the gap in my original testing: I exercised FORCE_MIRROR=1
(skips the primary call) and primary-happy-path (returns 0, no errexit),
but never the "primary called, primary fails, fallback fires" path.
The CI caught exactly what it was designed to catch.

Refs: #411, #415

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/fixtures/init-corpus/setup.sh

@@ -129,10 +129,18 @@ for i in $(seq 0 $((fixture_count - 1))); do
   #    Mirror is only consulted after primary has been attempted (or when
   #    AQE_CORPUS_FORCE_MIRROR=1). A successful fallback logs a loud
   #    WARNING so CI logs surface codeload drift even when the job is green.
+  #
+  #    IMPORTANT: under `set -e`, a bare non-zero function return triggers
+  #    errexit BEFORE the next line can capture $?. Using `if func; then`
+  #    exempts the call from errexit so we can actually read the return
+  #    code and fall through to the mirror path.
   rc=99
   if [[ "${FORCE_MIRROR}" != "1" ]]; then
-    download_and_verify "${url}" "${sha256}" "${cache_path}" "primary"
-    rc=$?
+    if download_and_verify "${url}" "${sha256}" "${cache_path}" "primary"; then
+      rc=0
+    else
+      rc=$?
+    fi
   fi
 
   if [[ "${rc}" -ne 0 ]]; then
@@ -160,8 +168,12 @@ for i in $(seq 0 $((fixture_count - 1))); do
       fi
     fi
 
-    download_and_verify "${mirror_url}" "${sha256}" "${cache_path}" "mirror"
-    mrc=$?
+    # Same set -e exemption as the primary call above.
+    if download_and_verify "${mirror_url}" "${sha256}" "${cache_path}" "mirror"; then
+      mrc=0
+    else
+      mrc=$?
+    fi
     if [[ "${mrc}" -eq 1 ]]; then
       echo "[corpus]   ERROR: mirror download also failed for ${id} (${mirror_url})" >&2
       download_failures=$((download_failures + 1))