fix: properly separate JSON output from Bazel logs in workflow

Redirect stdout (JSON results) and stderr (Bazel logs) to separate files
so that jq can cleanly parse the JSON without log noise. Also save and
display logs for debugging purposes.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: avrabe

.github/workflows/weekly-checksum-update.yml

@@ -93,13 +93,19 @@ jobs:
 
           echo "Running checksum updater with tools: $TOOLS"
 
-          # Run the updater and capture output (stderr to stdout is visible, stdout to file for JSON parsing)
+          # Run the updater and capture output
+          # Capture stdout (JSON results) separately from stderr (logs/errors)
           if [ "$TOOLS" = "all" ]; then
-            bazel run //tools/checksum_updater:checksum_updater_bin -- update-all $FORCE_FLAG $DRY_RUN_FLAG --output-format json 2>&1 | tail -n 1 > update_results.json
+            bazel run //tools/checksum_updater:checksum_updater_bin -- update-all $FORCE_FLAG $DRY_RUN_FLAG --output-format json > update_results.json 2>update_logs.txt || true
           else
-            bazel run //tools/checksum_updater:checksum_updater_bin -- update --tools "$TOOLS" $FORCE_FLAG $DRY_RUN_FLAG --output-format json 2>&1 | tail -n 1 > update_results.json
+            bazel run //tools/checksum_updater:checksum_updater_bin -- update --tools "$TOOLS" $FORCE_FLAG $DRY_RUN_FLAG --output-format json > update_results.json 2>update_logs.txt || true
           fi
 
+          # Show logs for debugging
+          echo "=== Update Tool Logs ==="
+          cat update_logs.txt || true
+          echo "=== End Logs ==="
+
           # Check if any updates were made
           UPDATES_COUNT=$(jq '.summary.tools_updated' update_results.json)
           NEW_VERSIONS_COUNT=$(jq '.summary.new_versions_found' update_results.json)
@@ -112,8 +118,8 @@ jobs:
           # Store results for later steps
           cp update_results.json ./update_results.json
 
-          # Generate summary for PR description (suppress Bazel logs, keep only command output)
-          bazel run //tools/checksum_updater:checksum_updater_bin -- generate-summary update_results.json 2>&1 | tail -n +1 | grep -v "^INFO\|^WARN\|^ERROR\|^Computing\|^Loading\|^Analyzing\|^Target\|^INFO:" > ./update_summary.md || true
+          # Generate summary for PR description
+          bazel run //tools/checksum_updater:checksum_updater_bin -- generate-summary update_results.json > ./update_summary.md 2>>/dev/null || true
 
       - name: Validate updated checksums
         if: steps.update.outputs.updates_count > 0