Prove the migrated mise path end to end and harden discovery per Momus

The self-test now runs sync_package over the checked-in mise-bin package --
its real metadata and PKGBUILD, the full selection/validation/backstop/
rewrite/read-back path -- with only the two network fetches replaced by
mise-shaped fixtures, asserting the final PKGBUILD holds the quarantine-
cleared version, pkgrel 1, and both architecture checksums.

Review fixes: the release-row builder uses "" fallbacks instead of empty
so a malformed row cannot shift columns past the per-field checks, and
provider discovery now keys on the presence of an upstream declaration
rather than a well-formed one, with sync_package failing loudly on a
declaration it cannot use -- a malformed manifest can no longer silently
drop a package out of scheduled synchronization.

helpers/upstream-github.sh

@@ -104,7 +104,10 @@ github_upstream_release() {
       best_pkgver=$pkgver
       best_published_at=$published_at
     fi
-  done < <(jq -r '.[] | select((.draft or .prerelease) | not) | [.tag_name // empty, .published_at // empty] | @tsv' <<<"$releases")
+  # `// ""` rather than `// empty`: empty would drop the field and shift the
+  # columns, so a malformed row could masquerade as a different one instead
+  # of tripping the per-field checks above.
+  done < <(jq -r '.[] | select((.draft or .prerelease) | not) | [.tag_name // "", .published_at // ""] | @tsv' <<<"$releases")
 
   if (( candidates == 0 )); then
     echo "no stable releases found in the feed for $repo" >&2