fix: add -f to curl to fail on HTTP >= 400

Without -f, a rejected credential (HTTP 401) returns curl exit 0, making
a failed alert indistinguishable from a successful one. With -f, curl
exits non-zero on HTTP >= 400, so DM_EXIT and STREAM_EXIT correctly
capture the transmission failure and the run log records it.

scripts/contract-run.sh

@@ -104,7 +104,7 @@ else
     if [ -n "$ZULIP_API_KEY" ] && command -v curl &> /dev/null; then
         # DM to user 9
         DM_EXIT=0
-        curl -s -X POST "${ZULIP_API_URL}/messages" \
+        curl -sf -X POST "${ZULIP_API_URL}/messages" \
             -u "${ZULIP_USER}:${ZULIP_API_KEY}" \
             -d "type=private" \
             -d "to=9" \
@@ -112,7 +112,7 @@ else
         
         # Stream agent-hub topic alerts-infra
         STREAM_EXIT=0
-        curl -s -X POST "${ZULIP_API_URL}/messages" \
+        curl -sf -X POST "${ZULIP_API_URL}/messages" \
             -u "${ZULIP_USER}:${ZULIP_API_KEY}" \
             -d "type=stream" \
             -d "to=agent-hub" \