ci: skip winget update during the first-submission window

[bsg62]

Adds a guard to the update-winget job so a release cut while the first WebCodr.jwtd submission is still under moderation is handled cleanly.

Why

komac update needs a merged base manifest as its template. WebCodr.jwtd is not yet in winget-pkgs main — the first submission (PR microsoft/winget-pkgs#407788, "New package … 5.2.0") is still in moderation. Cutting another release now would make komac either fail or open a second "New package" PR competing with the first.

What

A new first step queries whether the package exists in winget-pkgs main:

- name: Check whether WebCodr.jwtd is already in winget-pkgs
  id: pkg
  env:
    GH_TOKEN: ${{ github.token }}
  run: |
    if gh api repos/microsoft/winget-pkgs/contents/manifests/w/WebCodr/jwtd >/dev/null 2>&1; then
      echo "exists=true" >> "$GITHUB_OUTPUT"
    else
      echo "exists=false" >> "$GITHUB_OUTPUT"
      echo "::notice::… skipping the WinGet submission until the first-submission PR merges."
    fi

The download/verify/install-komac/submit steps are gated on steps.pkg.outputs.exists == 'true'. So during the first-submission window the job skips cleanly (emits a GHA notice) instead of failing or opening a duplicate PR; once the first PR merges and the package is in main, the guard passes and normal automation resumes with no further changes.

This changes nothing for the other channels — Homebrew/Scoop/AUR/COPR/release are independent jobs (needs: [validate, release]), unaffected either way.

Tests

TestWinGetInvariants now asserts the existence-check step exists and that the komac install/submit steps are gated on its output. Full suite + workflow security invariants pass. (The guard comment deliberately avoids the word the step-finder greps for, so the existing komac-step lookups stay unambiguous.)

🤖 Generated with Claude Code