ci: Harden update workflow

Fail clearly when curl/jq/python3 are missing, when the feed cannot be
parsed, or when the PKGBUILD rewrite does not stick. A scheduled bump
still commits PKGBUILD+.SRCINFO, tags v$pkgver, and pushes; a no-op is
only an already-current pkgver.

.gitea/workflows/update.yml

@@ -13,12 +13,19 @@ jobs:
         run: |
           set -euo pipefail
           sudo apt-get update -qq
-          sudo apt-get install -y -qq jq curl
+          sudo apt-get install -y -qq jq curl python3
+          for cmd in jq curl python3; do
+            command -v "$cmd" >/dev/null || { echo "error: missing $cmd" >&2; exit 1; }
+          done
           before=$(sed -n 's/^pkgver=//p' PKGBUILD)
           ./scripts/update.sh
           after=$(sed -n 's/^pkgver=//p' PKGBUILD)
+          if [[ -z "$after" ]]; then
+            echo "error: could not read pkgver after update.sh" >&2
+            exit 1
+          fi
           if [[ "$before" == "$after" ]]; then
-            echo "No bump"
+            echo "No bump (still $after)"
             exit 0
           fi
           git config user.name 's1d3sw1ped_bot'