update-policy: stop on a .golangci.yml line the canonical file lacks

A repo's own lint setting outside the test-support deny list was
deleted, and the deletion pushed with exit 0. The script now stops
and names each such line.

The check is one function that both merge steps call. An indented #
line now counts as a comment, as YAML needs.

Without --fail the stub curl now writes an error page and exits 0,
and the bad-hash scenario checks for the fetch error.

Model: opus-5-5

script/update-policy

@@ -13,7 +13,8 @@
 #     canonical file's last line. An entry above that line which the
 #     canonical file lacks stops the script.
 #   - .golangci.yml: the entries the repo added to the deny list of the
-#     test-support rule
+#     test-support rule. Any other line the canonical file lacks stops
+#     the script, unless it is blank or a comment.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -56,6 +57,16 @@ local_path() {
     fi
 }
 
+# local_only_lines <fetched> <local> [end]: print each line of the local
+# file, above line end if given, that the fetched file lacks. Blank
+# lines and comments do not count.
+local_only_lines() {
+    awk -v end="${3:-}" '
+        NR == FNR { fetched[$0]; next }
+        (end == "" || FNR < end) && !/^[ \t]*(#|$)/ && !($0 in fetched)
+    ' "$1" "$2"
+}
+
 # keep_lines_below_last <fetched> <local>: append to the fetched file
 # whatever follows its last line in the local file. Stop if a line above
 # that one is missing from the fetched file, unless it is blank or a
@@ -66,10 +77,7 @@ keep_lines_below_last() {
     if [ -z "$last" ] || [ -z "$number" ]; then
         die "$2 lacks this line; add it and put the repo's own entries below it: $last"
     fi
-    own="$(awk -v end="$number" '
-        NR == FNR { fetched[$0]; next }
-        FNR < end && !/^#|^[ \t]*$/ && !($0 in fetched)
-    ' "$1" "$2")"
+    own="$(local_only_lines "$1" "$2" "$number")"
     if [ -n "$own" ]; then
         die "$2 has entries above its last canonical line that the canonical file lacks; move each below that line to keep it, or delete it:
 $own"
@@ -80,7 +88,8 @@ $own"
 # keep_deny_entries <fetched> <local>: add to the deny list of the
 # test-support rule in the fetched file the entries only the local file
 # has. An entry is a "- pkg:" line, the lines under it and any comment
-# above it.
+# above it. Stop if the local file still has a line the result lacks,
+# unless it is blank or a comment: replacing the file would delete it.
 keep_deny_entries() {
     awk '
         function indent(line) { return match(line, /[^ ]/) - 1 }
@@ -132,6 +141,11 @@ keep_deny_entries() {
     ' "$2" "$1" > "$1.merged" ||
         die "the fetched $2 has no deny list in its test-support rule"
     mv "$1.merged" "$1"
+    own="$(local_only_lines "$1" "$2")"
+    if [ -n "$own" ]; then
+        die "$2 has lines the canonical file lacks; add each to the canonical file to keep it, or delete it:
+$own"
+    fi
 }
 
 main() {