fix: correctly extract archive path from ActionResult-wrapped SAT results

extractArchivePath only stripped the "Archive written to " prefix when
the string ended in ".tar.gz", but SAT packs write bare run directories,
never actual tar.gz archives. Any task routed through an
ActionResult-wrapping pack function (e.g. RunNvidiaAcceptancePackWithOptions,
used by the DCGM L1-L4 diag task) passed the whole prefixed string into
ReadSATOverallStatus, which then failed to find summary.txt and silently
returned "", masking real job failures as task-level "done".

Strip the prefix directly instead of gating on a suffix that SAT run
dirs never have.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

audit/internal/app/component_status_db.go

@@ -223,8 +223,8 @@ func satStatusToDBStatus(overall string) string {
 	}
 }
 
-// ExtractArchivePath extracts a bare .tar.gz path from a string that may be
-// "Archive written to /path/foo.tar.gz" or already a bare path.
+// ExtractArchivePath extracts a bare path from a string that may be
+// "Archive written to /path/to/run-dir" or already a bare path.
 func ExtractArchivePath(s string) string {
 	return extractArchivePath(s)
 }
@@ -247,11 +247,8 @@ func ReadSATOverallStatus(archivePath string) string {
 
 func extractArchivePath(s string) string {
 	s = strings.TrimSpace(s)
-	if strings.HasSuffix(s, ".tar.gz") {
-		parts := strings.Fields(s)
-		if len(parts) > 0 {
-			return parts[len(parts)-1]
-		}
+	if rest, ok := strings.CutPrefix(s, "Archive written to "); ok {
+		return strings.TrimSpace(rest)
 	}
 	return s
 }

audit/internal/app/component_status_db_test.go

@@ -0,0 +1,42 @@
+package app
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestExtractArchivePath(t *testing.T) {
+	cases := map[string]string{
+		"/appdata/bee/export/bee-sat/gpu-nvidia-20260706-174722":                    "/appdata/bee/export/bee-sat/gpu-nvidia-20260706-174722",
+		"Archive written to /appdata/bee/export/bee-sat/gpu-nvidia-20260706-174722": "/appdata/bee/export/bee-sat/gpu-nvidia-20260706-174722",
+		"Archive written to /path/with spaces/foo.tar.gz":                           "/path/with spaces/foo.tar.gz",
+		"  Archive written to /path/foo.tar.gz  ":                                   "/path/foo.tar.gz",
+	}
+	for in, want := range cases {
+		if got := ExtractArchivePath(in); got != want {
+			t.Errorf("ExtractArchivePath(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestReadSATOverallStatus_HandlesActionResultPrefix(t *testing.T) {
+	runDir := t.TempDir()
+	summary := "run_at_utc=2026-07-06T17:47:22Z\noverall_status=FAILED\n"
+	if err := os.WriteFile(filepath.Join(runDir, "summary.txt"), []byte(summary), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	// Regression: RunNvidiaAcceptancePackWithOptions wraps the bare run dir as
+	// "Archive written to <dir>" before it reaches ReadSATOverallStatus. If the
+	// prefix isn't stripped, the summary.txt lookup silently fails and a FAILED
+	// sub-job never surfaces as a task failure.
+	wrapped := "Archive written to " + runDir
+	if got := ReadSATOverallStatus(ExtractArchivePath(wrapped)); got != "FAILED" {
+		t.Errorf("ReadSATOverallStatus(wrapped) = %q, want FAILED", got)
+	}
+
+	if got := ReadSATOverallStatus(ExtractArchivePath(runDir)); got != "FAILED" {
+		t.Errorf("ReadSATOverallStatus(bare) = %q, want FAILED", got)
+	}
+}