fix: fail safely when AUR synchronization fails

.gitea/workflows/update.yaml

@@ -81,8 +81,22 @@ jobs:
           chmod 600 ~/.git-credentials
 
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
+
+          # Validate the key HERE rather than letting it surface as an opaque
+          # `Permission denied (publickey)` at push time, several steps later.
+          if [ -z "${AUR_SSH_KEY//[[:space:]]/}" ]; then
+            echo "::error::AUR_SSH_KEY secret is empty or unset" >&2
+            exit 1
+          fi
           printf '%s\n' "${AUR_SSH_KEY}" > ~/.ssh/aur
           chmod 600 ~/.ssh/aur
+          if ! ssh-keygen -y -P "" -f ~/.ssh/aur >/dev/null 2>&1; then
+            echo "::error::AUR_SSH_KEY is not a usable unencrypted private key." >&2
+            echo "Paste the whole file including the BEGIN/END lines; a passphrase-protected key cannot be used unattended." >&2
+            exit 1
+          fi
+          echo "AUR key fingerprint: $(ssh-keygen -lf ~/.ssh/aur | awk '{print $2}')"
+
           ssh-keyscan -t rsa,ecdsa,ed25519 aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null
           cat >> ~/.ssh/config <<'EOF'
           Host aur.archlinux.org