[YusufKaya00]

Summary

• preserve the wrapped command's exit status while still teeing Cargo Audit and Clippy output into job logs
• make dependency advisories and the targeted panic/unwrap/expect Clippy lints fail their steps instead of producing green false summaries
• update crossbeam-epoch and quick-xml to patched releases so the audit gate starts green; adapt the quick-xml text API and cover entity decoding

This addresses items 1 and 2 from #3394. The issue's separate lint-policy, Semgrep, release-trigger, and benchmark questions are intentionally left out of this focused PR.

Test plan

• cargo fmt --all -- --check
• bash scripts/run-with-log.sh --self-test
• cargo metadata --no-deps --format-version 1
• cargo audit 0.22.2 (no vulnerabilities; one allowed informational warning)
• actionlint .github/workflows/ci.yml
• cargo clippy --all-targets && cargo test — delegated to the PR matrix because this Windows host does not have the MSVC linker/Build Tools installed

AI assistance disclosure

AI assistance was used for issue triage, implementation, and test drafting. I reviewed the final diff, verified the dependency advisories against RustSec, and ran the checks listed above.

[CLAassistant]

All committers have signed the CLA.

[pszymkowiak]

Thanks for the contribution! Before we can review and merge this, the CLA needs to be signed. The CLAassistant bot left the link above, it only takes a minute. Once it's signed we'll pick the review up.