dotfiles-autoupdate: run the ssh rewrite before the gantry CLI refresh

[DJRHails]

Follow-up to #131 (already merged), fixing the one finding from its post-merge review.

ensure_gantry_cli_fresh clones the private DJRHails/gantry repo over git+https and — per its own comment — relies on the insteadOf rewrite that ensure_github_ssh_rewrite writes, yet it ran before that step. On a keyed host whose ~/.gitconfig.github-ssh include-file is missing (exactly the migration case the rewrite step exists for, including the very run whose update_dotfiles pulls the commit that moved the rewrite out of the tracked gitconfig), a drifted install hit an unauthenticated clone, logged gantry: FAILED, and only converged a day late.

One-line reorder of the call sequence, plus the ordering constraint stated in the function's comment so a future shuffle doesn't silently regress it. ensure_github_ssh_rewrite has no dependency in the other direction.

Verified: bash -n, shellcheck clean, shfmt clean on the touched lines, all pre-commit hooks passed.

via gantry

[DJRHails]

Automated review — direct single-pass (7-line follow-up delta from PR #131's post-merge review; no agent fan-out). The reorder itself checks out: ensure_github_ssh_rewrite only reads ~/.ssh/config and writes ~/.gitconfig.github-ssh, so it has no dependency on the gantry step, and it still runs after update_dotfiles so a freshly-pulled include directive is honored the same day. One finding posted inline; its thread is resolved as the fix lands.

via gantry

[DJRHails]

Review Summary

Direct single-pass review (7-line follow-up delta from PR #131's post-merge review — no agent fan-out). The reorder is verified correct: ensure_github_ssh_rewrite only reads ~/.ssh/config and writes ~/.gitconfig.github-ssh, so it has no dependency on the gantry step in the other direction, and it still runs after update_dotfiles, so a freshly-pulled include directive is honored the same day.

Findings

#	Severity	Finding	Resolution
1	P2	The ordering constraint is enforced only by a comment — tests/dotfiles-autoupdate.test.sh (this script's regression net, run at every commit) doesn't pin it, so a future shuffle of the call list would regress silently	Fixed in 47de79e: added a behavior test — a uv stub records whether ~/.gitconfig.github-ssh existed when uv tool install fired on a keyed host; break-checked by reverting the order (fails with [missing])

Verification

• Tests: tests/dotfiles-autoupdate.test.sh all checks pass (incl. 2 new gantry checks); tests/link-symlinks.test.sh pass; all pre-commit hooks passed at commit time (gitleaks, trufflehog, glassine, 6 behavior suites)
• Lint: shellcheck clean on update.sh and the test suite; bash -n clean
• Format: touched lines clean (shfmt diffs on update.sh are pre-existing lines outside this PR)

Commit

47de79e — fix: resolve code review findings for PR #133

Verdict: approve

via gantry