Prove the migrated mise path end to end and harden discovery per Momus

The self-test now runs sync_package over the checked-in mise-bin package --
its real metadata and PKGBUILD, the full selection/validation/backstop/
rewrite/read-back path -- with only the two network fetches replaced by
mise-shaped fixtures, asserting the final PKGBUILD holds the quarantine-
cleared version, pkgrel 1, and both architecture checksums.

Review fixes: the release-row builder uses "" fallbacks instead of empty
so a malformed row cannot shift columns past the per-field checks, and
provider discovery now keys on the presence of an upstream declaration
rather than a well-formed one, with sync_package failing loudly on a
declaration it cannot use -- a malformed manifest can no longer silently
drop a package out of scheduled synchronization.

helpers/package-metadata.sh

@@ -178,9 +178,12 @@ package_has_upstream_hook() {
 }
 
 package_has_upstream_provider() {
-  local pkgdir="$1"
-  # `objects` drops a non-object upstream value instead of erroring jq.
-  [[ -n "$(package_metadata_value "$pkgdir" '(.upstream? | objects | .github)' "")" ]]
+  local pkgdir="$1" metadata
+  metadata=$(metadata_file_for_dir "$pkgdir")
+  [[ -f "$metadata" ]] || return 1
+  # Any upstream key counts, valid or not: a malformed declaration must reach
+  # bin/sync-upstream and fail loudly there, not vanish from discovery.
+  jq -e 'has("upstream")' "$metadata" >/dev/null
 }
 
 packages_for_upstream_sync() {