ci: Harden update workflow

Fail clearly when curl/jq/python3 are missing, when the feed cannot be
parsed, or when the PKGBUILD rewrite does not stick. A scheduled bump
still commits PKGBUILD+.SRCINFO, tags v$pkgver, and pushes; a no-op is
only an already-current pkgver.

scripts/update.sh

@@ -3,6 +3,10 @@
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
+for cmd in curl jq python3 sha256sum; do
+  command -v "$cmd" >/dev/null || { echo "error: missing required command: $cmd" >&2; exit 1; }
+done
+
 FEED='https://api2.cursor.sh/updates/api/update/linux-x64/sand/0.0.0/00000000-0000-0000-0000-000000000000/stable'
 resp=$(curl -fsSL "$FEED")
 version=$(jq -r .version <<<"$resp")
@@ -10,7 +14,11 @@ commit=$(jq -r .url <<<"$resp" | sed -E 's#.*/stable/([^/]+)/.*#\1#')
 current=$(sed -n 's/^pkgver=//p' PKGBUILD)
 
 if [[ -z "$version" || "$version" == "null" || ! "$commit" =~ ^[0-9a-f]{40}$ ]]; then
-  echo "Could not parse update feed: $resp" >&2
+  echo "error: could not parse update feed: $resp" >&2
+  exit 1
+fi
+if [[ -z "$current" ]]; then
+  echo "error: could not read pkgver from PKGBUILD" >&2
   exit 1
 fi
 if [[ "$version" == "$current" ]]; then
@@ -33,6 +41,12 @@ sed -i \
   -e "s/^pkgrel=.*/pkgrel=1/" \
   PKGBUILD
 
+newver=$(sed -n 's/^pkgver=//p' PKGBUILD)
+if [[ "$newver" != "$version" ]]; then
+  echo "error: PKGBUILD pkgver rewrite failed (got ${newver@Q}, expected ${version@Q})" >&2
+  exit 1
+fi
+
 python3 - "$deb_sha" "$shim_sha" <<'PY'
 import pathlib, re, sys
 deb_sha, shim_sha = sys.argv[1], sys.argv[2]