ci: legible errors for a missing baseline and an unparseable reader

Two review nits: check_allowlist_closed() raised a traceback when
--baseline-exceptions pointed at a missing file (the error now says CI
derives it from the base branch and local runs should omit the flag), and
check_key_coverage() would traceback on a reader with a SyntaxError (now a
::error:: naming the module — belt-and-braces, since such a module can't
pass pytest either, but this job may run first).

Signed-off-by: topkoa <topkoa@gmail.com>

tools/check_spec_conformance.py

@@ -249,6 +249,12 @@ def check_allowlist_closed(baseline: Path | None, bootstrap: bool) -> bool:
         print("  allowlist-closed: no baseline supplied (local run) — skipped")
         return True
 
+    if not baseline.is_file():
+        _fail(
+            f"--baseline-exceptions {baseline} does not exist. CI derives this from the base "
+            f"branch; for a local run, omit the flag to skip the allowlist diff."
+        )
+        return False
     base_keys = set(
         _parse_exceptions(baseline.read_text(encoding="utf-8"), f"{EXCEPTIONS_FILE.name} (base)")
     )
@@ -323,7 +329,14 @@ def check_key_coverage(spec: Path) -> bool:
         if not path.exists():
             _fail(f"reader {rel} not found — was it renamed? Update READERS in {Path(__file__).name}.")
             return False
-        r, w = keys_touched(path)
+        try:
+            r, w = keys_touched(path)
+        except SyntaxError as e:
+            # A module that doesn't parse can't be scanned — but it also can't
+            # pass pytest, so this is belt-and-braces for a CI-legible message
+            # rather than a traceback if this job runs first.
+            _fail(f"could not scan {rel}: {e}")
+            return False
         reads |= r
         writes |= w