update-policy: stop on a .golangci.yml line the canonical file lacks

A repo's own lint setting outside the test-support deny list was
deleted, and the deletion pushed with exit 0. The script now stops
and names each such line.

The check is one function that both merge steps call. An indented #
line now counts as a comment, as YAML needs.

Without --fail the stub curl now writes an error page and exits 0,
and the bad-hash scenario checks for the fetch error.

Model: opus-5-5

test/update-policy.sh

@@ -21,8 +21,10 @@ write_stub_curl() {
     cat > "$dir/bin/curl" << 'EOF'
 #!/bin/sh
 previous=""
+fail_flag=""
 for argument in "$@"; do
     [ "$previous" = "--output" ] && output="$argument"
+    [ "$argument" = "--fail" ] && fail_flag=yes
     previous="$argument"
 done
 url="$previous"
@@ -30,7 +32,9 @@ base="https://git.eeqj.de/sneak/prompts/raw/commit/$HASH/"
 path="${url#"$base"}"
 source="$(dirname "$0")/../canonical/$path"
 if [ "$path" = "$url" ] || [ ! -f "$source" ]; then
-    exit 22
+    [ -n "$fail_flag" ] && exit 22
+    echo "404 page not found" > "$output"
+    exit 0
 fi
 cp "$source" "$output"
 EOF
@@ -322,6 +326,8 @@ test_bad_commit_hash() {
         expect_failure
         expect_nothing_written
     done
+    # The last hash has the right form, so it is the one that reaches curl.
+    expect_output "cannot fetch"
 }
 
 test_push_failure() {
@@ -420,6 +426,24 @@ EOF
     expect_nothing_written
 }
 
+test_own_golangci_setting_stops() {
+    start_scenario "a .golangci.yml setting the canonical file lacks stops"
+    cat >> "$dir/repo/.golangci.yml" << 'EOF'
+    # A comment of our own.
+    forbidigo:
+      forbid:
+        - pattern: model.Operator
+EOF
+    commit_and_push_fixture .golangci.yml .prettierrc
+    run_update_policy "$HASH"
+    expect_failure
+    expect_output ".golangci.yml has lines"
+    expect_output "forbidigo:"
+    expect_output "- pattern: model.Operator"
+    expect_output_without "A comment of our own."
+    expect_nothing_written
+}
+
 test_source_repo_stops() {
     start_scenario "the repo the policy files come from stops"
     printf '#!/bin/sh\necho prompts\n' > "$dir/repo/script/projectname"
@@ -484,6 +508,7 @@ main() {
     test_uncommitted_change_stops
     test_gitignore_lacks_canonical_last_line
     test_fetched_golangci_without_deny_list
+    test_own_golangci_setting_stops
     test_source_repo_stops
     test_staged_file_stays_out_of_commit
     test_short_commit_hash_refused