fix(steamdeck): the updater stops dirtying the checkout it just pulled into

`update.sh --pull` could abort with "Your local changes to the following files
would be overwritten by merge: web/bun.nix" — before a single service was
restarted — and the only way past it was to delete the file by hand.

The updater did it to itself. web/bun.nix is generated (bun2nix, a pure
function of web/bun.lock) but committed, because the Nix build fetches
node_modules only from it. The web step ran `bun install --frozen-lockfile`
without --ignore-scripts, so web's `postinstall` (`bun2nix -o bun.nix`)
rewrote that tracked file on every update. Harmless while the committed file
is in sync — but main carried a stale web/bun.nix from 1db8f763 to b79d90b4,
so any Deck updated in that window had it rewritten to the *correct* content
and has been sitting dirty ever since. The SDK step has always passed
--ignore-scripts, which is why only web/bun.nix ever went dirty.

Two changes, both in install.sh and update.sh:

  * the web install now passes --ignore-scripts and runs `bun run codegen`
    explicitly. web has two install lifecycle scripts and we want exactly one:
    `prepare` IS `bun run codegen` (orval + paraglide + the i18n check) and is
    required, since src/api/gen, src/paraglide and src/routeTree.gen.ts are
    gitignored and `prebuild` only re-runs orval; `postinstall` is the one that
    writes a committed file. Equivalent to the old behaviour minus bun2nix.

  * --pull restores web/bun.nix and sdk/bun.nix before pulling, which unsticks
    the installs already broken out there. Deliberately NOT `git reset --hard`:
    $SRC is the operator's own checkout and may carry real local work, so a
    still-dirty tree now fails with a message that names the files and the way
    out instead of git's raw abort. Discarding these two is provably lossless —
    regenerating them from the lockfiles is exactly what bun2nix does.

CI already gates the drift that made this visible (scripts/ci/check-bun-nix.sh,
ci.yml), so main cannot ship a stale bun.nix again.

scripts/steamdeck/install.sh

@@ -147,7 +147,10 @@ if [ "$WITH_WEB" = 1 ]; then
     distrobox enter "$BOX" -- bash -lc "
 set -e
 export PATH=\$HOME/.bun/bin:\$PATH
-cd '$SRC/web' && bun install --frozen-lockfile && bun run build
+# --ignore-scripts + explicit codegen: keep in step with scripts/steamdeck/update.sh, which
+# explains why (web's `postinstall` writes the COMMITTED web/bun.nix; its `prepare`/codegen is
+# required because src/api/gen, src/paraglide and src/routeTree.gen.ts are gitignored).
+cd '$SRC/web' && bun install --frozen-lockfile --ignore-scripts && bun run codegen && bun run build
 "
     [ -f "$SRC/web/.output/server/index.mjs" ] || die "web build did not produce web/.output/server/index.mjs"
     ok "web console built"

scripts/steamdeck/update.sh

@@ -20,7 +20,28 @@ TARGET_DIR="$SRC/target-steamos"
 WEB=0; [ -f "$HOME/.config/systemd/user/punktfunk-web.service" ] && WEB=1
 
 if [ "${1:-}" = "--pull" ]; then
-    if [ -d "$SRC/.git" ]; then log "git pull"; git -C "$SRC" pull --ff-only; ok "pulled"; else die "$SRC is not a git checkout — rsync new source then run without --pull"; fi
+    [ -d "$SRC/.git" ] || die "$SRC is not a git checkout — rsync new source then run without --pull"
+    # web/bun.nix and sdk/bun.nix are GENERATED (bun2nix, a pure function of the matching bun.lock —
+    # packaging/nix/README.md) yet COMMITTED, because the Nix build fetches node_modules only from
+    # them. Until the --ignore-scripts fix below, web's `bun install` here ran its `postinstall`
+    # (`bun2nix -o bun.nix`) and rewrote that tracked file on every single update. That is invisible
+    # while the committed file is in sync — but main carried a STALE web/bun.nix from 1db8f763 to
+    # b79d90b4, so any Deck updated in that window had the file rewritten to the *correct* content
+    # and has been sitting dirty ever since. The next `git pull --ff-only` that touches it then dies
+    # with "Your local changes to the following files would be overwritten by merge", and the update
+    # stops before a single service is restarted.
+    #
+    # Restore ONLY these two derived paths. Not a blanket `git reset --hard`: $SRC is the operator's
+    # own checkout (they may have patched a source file, or be carrying a cherry-pick), and silently
+    # deleting that to save an update is a far worse trade than one legible error. Discarding these
+    # two is provably lossless — regenerating them from the lockfiles is exactly what bun2nix does.
+    git -C "$SRC" checkout -- web/bun.nix sdk/bun.nix 2>/dev/null || true
+    log "git pull"
+    git -C "$SRC" pull --ff-only \
+        || die "git pull --ff-only failed in $SRC. If it named locally-modified files, this checkout
+  has local changes: review them with 'git -C $SRC status', then commit or stash them (or discard
+  one with 'git -C $SRC checkout -- <file>') and re-run. Nothing was rebuilt or restarted."
+    ok "pulled"
 fi
 
 log "Rebuilding host (release)"
@@ -29,7 +50,14 @@ distrobox enter "$BOX" -- bash -lc "set -e; export PATH=\$HOME/.cargo/bin:\$PATH
 ok "host rebuilt"
 if [ "$WEB" = 1 ]; then
     log "Rebuilding web console"
-    distrobox enter "$BOX" -- bash -lc "set -e; export PATH=\$HOME/.bun/bin:\$PATH; cd '$SRC/web' && bun install --frozen-lockfile && bun run build"
+    # --ignore-scripts, then `bun run codegen` explicitly: web has TWO install lifecycle scripts and
+    # we want exactly one of them. `prepare` (= codegen: orval + paraglide + the i18n check) is
+    # REQUIRED — src/api/gen, src/paraglide and src/routeTree.gen.ts are gitignored, and `prebuild`
+    # only re-runs orval, so dropping codegen leaves the build without its i18n messages. But
+    # `postinstall` (`bun2nix -o bun.nix`) writes a COMMITTED file, and an updater must never dirty
+    # the tree it just pulled into — that is what broke `--pull` above. The SDK install below has
+    # always passed --ignore-scripts, which is why only web/bun.nix ever went dirty.
+    distrobox enter "$BOX" -- bash -lc "set -e; export PATH=\$HOME/.bun/bin:\$PATH; cd '$SRC/web' && bun install --frozen-lockfile --ignore-scripts && bun run codegen && bun run build"
     ok "web rebuilt"
 fi