ci: make the approval notification able to fail (#35)

The step piped Telegram's reply to /dev/null and then printed 'Approver
notified' unconditionally. A stale token, a wrong chat id, a rejected message —
all of them ended with a green step and an approver who never heard about the
deploy.

That is not hypothetical. On 2026-08-01 run 30710528288 sat in 'waiting' with
the log reading 'Approver notified; deployment waits on the production
environment', and no message had arrived. Nothing in the run said otherwise,
so the first signal was a person asking why the deploy had not moved.

The reply is now checked and a rejection fails the job. Exchange's equivalent
step already did this; pwap's did not, because I wrote it without copying the
pattern that was already there and working.

.github/workflows/quality-gate.yml

@@ -338,7 +338,12 @@ jobs:
           # is still what holds the deploy — the bot only presses the button on the
           # reviewer's behalf, and the GitHub link stays as the fallback for when
           # the bot or its host is down.
-          curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
+          # Capture the reply. A notification step that discards it cannot fail:
+          # a stale token, a wrong chat id or a rejected message all end with
+          # the step printing success and the approver never hearing about the
+          # deploy. That happened on 2026-08-01 — the run sat waiting and the
+          # log said "Approver notified".
+          RESP=$(curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
             -H "Content-Type: application/json" \
             -d "{
               \"chat_id\": \"${CEO_CHAT_ID}\",
@@ -355,7 +360,12 @@ jobs:
                   ]
                 ]
               }
-            }" > /dev/null
+            }")
+
+          if ! echo "$RESP" | grep -q '"ok":true'; then
+            echo "::error::Telegram rejected the approval prompt: ${RESP:0:300}"
+            exit 1
+          fi
 
           echo "Approver notified; deployment waits on the 'production' environment."