fix(update-check): crash emits CHECK_FAILED instead of reading as up-to-date

gstack-update-check signals "up to date" with SILENCE, and it runs under
set -e — so any unguarded mid-script failure exited quietly and was
indistinguishable from a current install. Observed live as a 45-release
silent-staleness incident. An ERR trap (with -E so it propagates into
functions) now emits a CHECK_FAILED sentinel naming the line and status,
and exits 0 so caller `|| true` guards can't eat it. Behavioral tests cover
both the crash and the healthy-silent paths; egress-receipt wiring is
untouched and still pinned by test/egress-receipt-wiring.test.ts.

Fixes #1974. (#2378's HEAD-SHA staleness half was already fixed on main by
the ls-remote + SHA-pinned VERSION resolution — close as already-fixed.)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/gstack-update-check

@@ -13,6 +13,14 @@
 #   GSTACK_STATE_DIR    — override ~/.gstack state directory
 set -euo pipefail
 
+# A crash must not read as "up to date" (#1974). With set -e, any unguarded
+# failure used to exit silently — and silence IS the up-to-date signal, so a
+# broken check was indistinguishable from a current install (observed live as
+# a 45-release silent-staleness incident). -E propagates the trap into
+# functions/subshells; exit 0 keeps callers' `|| true` from eating the line.
+set -E
+trap 'rc=$?; echo "CHECK_FAILED gstack-update-check crashed (line $LINENO, rc=$rc) — update status UNKNOWN, not up-to-date"; exit 0' ERR
+
 GSTACK_DIR="${GSTACK_DIR:-$(cd "$(dirname "$0")/.." && pwd)}"
 STATE_DIR="${GSTACK_STATE_DIR:-$HOME/.gstack}"