fix(ci): guard bare [[ URL ]] last-command and initialize ARCH_DIGESTS=()

Two bugs affecting all non-goose apps (ghostty, thunderbird-nightly, virtualbox,
firefox-nightly, lmstudio, Kontainer, Tuner):

1. build.yml sign-and-push 'Read release metadata' step: bare
   '[[ -n "${URL}" ]] && echo ...' evaluates false for apps with no url
   field, causing the step to exit 1 under bash -e as the last command.
   Fix: append '|| true' so the step always exits 0.

2. Justfile push-manifest-list: 'declare -A ARCH_DIGESTS' with no explicit
   empty init causes 'ARCH_DIGESTS: unbound variable' under set -u when the
   associative array is empty (bash 4.x). Fix: 'declare -A ARCH_DIGESTS=()'
   with explicit empty initializer.

These fixes were present in the working tree after the PR merge but were never
committed. The squashed PR commit (2fb7cf5) shipped both bugs to main.

Also committed: AGENTS.md CI validation gate section — a goose-only green run
is insufficient for CI-wide changes; must also pass thunderbird-nightly.

Assisted-by: Claude Sonnet 4.6 via OpenCode

Author: castrojo

.github/workflows/build.yml

@@ -369,7 +369,7 @@ jobs:
             || echo "==> No version — only :latest will be pushed"
           URL=$(just metadata '${{ matrix.app }}' url 2>/dev/null || echo "")
           [[ "${URL}" == "null" ]] && URL=""
-          [[ -n "${URL}" ]] && echo "UPSTREAM_URL=${URL}" >> "$GITHUB_ENV"
+          [[ -n "${URL}" ]] && echo "UPSTREAM_URL=${URL}" >> "$GITHUB_ENV" || true
 
       - name: Download OCI artifact
         if: steps.arch-check.outputs.skip != 'true'

AGENTS.md

@@ -33,6 +33,21 @@ that area.
 When triggering a manual test build, always use `goose` (bundle-repack, fastest — no compile step).
 Never use `ghostty` for test builds (full Zig compile via flatpak-builder, very slow).
 
+## CI validation gate
+
+**A goose-only green run is not sufficient to declare any CI change complete.**
+
+goose is a `release.yaml` app with a `url` field. It exercises a different code path than
+`manifest.yaml` apps and apps without a `url` field (ghostty, thunderbird-nightly, virtualbox).
+
+**Before merging any change to `build.yml`, `Justfile`, or `update-index.yml`:**
+
+- Smoke test (fast): `goose` — catches most regressions quickly
+- Full gate: must also pass for at least one `manifest.yaml` app with no `url` field
+
+Use `thunderbird-nightly` as the second app (x86_64-only, no Zig compile, faster than ghostty).
+If the change is CI-wide (affects all apps/jobs), trigger **both** before declaring complete.
+
 ## Flatpak installation policy
 
 Always install Flatpaks system-wide. Never use `--user`.

Justfile

@@ -626,7 +626,7 @@ push-manifest-list app registry="ghcr.io":
     fi
 
     # Collect per-arch digests
-    declare -A ARCH_DIGESTS
+    declare -A ARCH_DIGESTS=()
     for ARCH in x86_64 aarch64; do
         DIGEST_FILE="/tmp/digests/${ARCH}/digest.txt"
         if [[ -f "${DIGEST_FILE}" ]]; then