CI: surface apply-patches failures in selfhost-preflight (#36247)

[PurHur]

Summary

• Remove || true swallow in selfhost_apply_patches_if_needed — bootstrap/M4 probes now fail when vendor patches cannot apply (same fast --verify-only path as ci-memory-env.sh).
• Add CiScriptsTest guards for selfhost-preflight and ci-common.sh apply-patches wiring.
• Reword README/CONTRIBUTING to describe local/Docker gates without "Actions disabled" phrasing.

Closes #36247 (partial — GHA workflow split / image cache / branch protection remain tracked on #36188).

Verification

./script/phpunit.sh --filter 'testCiMemoryEnvSurfacesApplyPatchesFailure|testSelfhostPreflightSurfacesApplyPatchesFailure|testCiInstallDepsInvokesApplyPatchesWithoutSwallow'
# OK (3 tests, 8 assertions)

make dev-verify-fast
# dev-verify-fast: OK (83s wall)
# aot-smoke: 9 passed, 0 failed
# VM differential tier-0: 15/15 match Zend

grep -ri "actions.*disabled" README.md CONTRIBUTING.md .cursor
# (no matches)

Not run: full north-star5-verify-fast (master was green pre-change; dev-verify-fast covers aot-smoke + VM tier-0).

Made with Cursor