fix(agents): pin the bd installer and stop hiding jq failures

Two findings from the review of #7.

The hook piped an unpinned installer from beads' `main` straight into a
shell. That runs code nobody has seen, from a URL whose contents can
change under us, and leaves nothing to inspect when something goes wrong.
It now downloads first and runs the file, so /tmp/bd-install.sh is
readable afterwards, and pins the revision: the peeled commit of tag
v1.3.0, which is the version this work was done against. The comment
carries the ls-remote incantation for bumping it. Byte-identical to
`main` today, so the pin costs nothing now and is the whole point later.

The seeding script read its input with `mapfile < <(jq …)`, and a process
substitution discards the exit status of what ran inside it. A malformed
or unreadable flake.lock therefore produced an empty list, which the next
branch reported as "no github-sourced inputs; nothing to seed" and exited
0 — the script would claim success having seeded nothing. jq's output is
now captured with the status checked, and emptiness is a separate case
from failure.

Verified by exercising the paths rather than reading them:

  malformed flake.lock -> error names the file, rc=1
  valid lock, no github inputs -> "nothing to seed", rc=0
  missing flake.lock -> error, rc=1
  installer download -> /tmp/bd-install.sh matches f45b249 byte for byte

shellcheck -S style clean on both scripts; the real seeding run still
completes with flake.lock unmodified.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DyHK7L8S1XDX3EihTnSKaX

scripts/nix-seed-flake-inputs.sh

@@ -41,18 +41,24 @@ if [ -z "${NIX_SSL_CERT_FILE:-}" ] && [ -r /root/.ccr/ca-bundle.crt ]; then
 fi
 NIX_FLAGS=(--extra-experimental-features 'nix-command flakes')
 
-mapfile -t INPUTS < <(
-  jq -r '.nodes | to_entries[] | .value.locked
-         | select(.type == "github" and .rev)
-         | "git+https://github.com/\(.owner)/\(.repo)?rev=\(.rev)&shallow=1"' flake.lock \
-  | sort -u
-)
+# Captured rather than piped straight into mapfile: a process substitution
+# hides jq's exit status, so an unreadable or malformed flake.lock would look
+# exactly like a lock with no github inputs and the script would exit 0 having
+# seeded nothing.
+if ! locked_inputs=$(jq -r '.nodes | to_entries[] | .value.locked
+       | select(.type == "github" and .rev)
+       | "git+https://github.com/\(.owner)/\(.repo)?rev=\(.rev)&shallow=1"' flake.lock); then
+  echo "error: could not read inputs from flake.lock — is it valid JSON?" >&2
+  exit 1
+fi
 
-if [ "${#INPUTS[@]}" -eq 0 ]; then
+if [ -z "$locked_inputs" ]; then
   echo "no github-sourced inputs in flake.lock; nothing to seed"
   exit 0
 fi
 
+mapfile -t INPUTS < <(printf '%s\n' "$locked_inputs" | sort -u)
+
 echo "seeding ${#INPUTS[@]} locked inputs over git (flake.lock is not modified)…"
 failed=0
 for url in "${INPUTS[@]}"; do