fix(ci): close two failure-notification gaps

[mkoura]

• The 'Move deselected_tests.txt artifact' step fails when the testing step dies before creating run_workdir (nix setup or workdir lock failures). Create the directory first, same as the failure-analysis steps already do.
• The failure mail does not require the CLAUDE_CODE_OAUTH_TOKEN secret, but the step that sets FAILURE_ANALYSIS did - without the token the mail rendered an empty string where the analysis belongs. Run the step regardless and set an explicit placeholder when the token is not configured.