ci: watch for a bundled driver pin left behind

[frahlg]

Closes the gap named in #704. That PR moves the pin; this one notices next time.

Two opposite questions

drivers/ is a snapshot of srcfl/device-drivers, and it can go wrong in two directions.

question	who asks it	when
did someone edit a driver here?	--check, the drivers job in test.yml	every pull request
was the pin left behind?	--behind, this workflow	daily

Only the first had an answer. That is how a Pixii poll-counter flap reached customer hardware a second time — fixed in device-drivers, still bundled here, and nothing in between to say so. The pin had aged five commits before anyone looked.

What it does

sync-bundled-drivers.sh gains --behind, which resolves device-drivers main and compares drivers/ against it rather than against the pin.

It reports which drivers would change, not that the commit id moved. A doc change or a dependency bump upstream stays quiet, which is what makes a daily schedule bearable — of the five commits this pin was behind, only two touched a bundled driver.

The workflow keeps one issue up to date instead of opening a new one each morning, and closes it once the pin catches up. An exit code other than 0 or 1 fails the job: a network or API failure must not read as "the pin is fine", and must not open an issue claiming drivers changed when we never found out.

Verification

Run against the current master, whose pin really is behind:

$ scripts/sync-bundled-drivers.sh --behind
fetching srcfl/device-drivers at 3f62a0050aea
OUTDATED pixii.lua
OUTDATED solaredge_legacy.lua
OUTDATED sungrow.lua

The bundled driver pin is out of date.

  pinned:   1f67078a54c44573b54483bb3f2b709cdf6ff7df
  upstream: 3f62a0050aea397f08771b586649c2af5e7bc170  (srcfl/device-drivers@main)
...
$ echo $?
1

That is the real staleness #704 fixes, found by the check rather than by a customer.

Existing modes are unchanged: --check still passes against the old pin (37 drivers match), plain sync is still a no-op, and an unknown option now exits 2 rather than being silently treated as sync. bash -n passes, which is what make already runs over this script.

Once #704 merges, --behind goes quiet on its own.

🤖 Generated with Claude Code