scripts: Parse update feed with python3 if jq is missing

Jumpboxes may lack jq; requiring it made the documented manual path
fail closed for the wrong reason. Keep python3 as the rewrite tool
and the feed parser fallback, and fail loudly when neither parser
nor curl/sha256sum is present. Reject tiny/non-deb downloads so a
failed fetch cannot look like a successful bump.

.gitea/workflows/update.yml

@@ -33,4 +33,10 @@ jobs:
           git add PKGBUILD .SRCINFO
           git commit -m "pkgbuild: Bump grok-bot-bin to ${after}"
           git tag "v${after}"
-          git push origin "HEAD:${GITHUB_REF_NAME}" "v${after}"
+          # Proven on this forge: run 1190 pushed master + tag v0.35.0.
+          # Still fail the job if push is denied rather than reporting a landed bump.
+          if ! git push origin "HEAD:${GITHUB_REF_NAME}" "v${after}"; then
+            echo "error: could not push commit/tag to ${GITHUB_REF_NAME} (v${after})." >&2
+            echo "error: Manual path: ./scripts/update.sh, commit, PR/merge, then tag v${after} and push the tag so build.yml can attach the release asset." >&2
+            exit 1
+          fi