update-apps: some improvements (#14275)

* feat(update-apps): add var_continue_on_error and TERM=dumb fix

- Add var_continue_on_error=yes to skip failed containers instead
  of aborting all remaining updates. Useful for cron/unattended runs
  where one disabled or broken script should not stop others.
  Containers with backup still attempt restore on failure regardless.

- Set TERM=dumb when running pct exec to prevent whiptail from
  hanging when no TTY is available (e.g. cron jobs redirecting
  stdout/stderr). This causes whiptail to fail-fast instead of
  blocking indefinitely.

- Add var_continue_on_error to export_config_json, --help output,
  and usage examples (cron-style invocation example added).

* feat(update-apps): add var_dry_run to check updates without applying

Adds dry-run mode (var_dry_run=yes) that reports available updates for
all selected containers without modifying anything:

- Extracts GitHub source repo from the ct script header (# Source:)
- Resolves the version file name from check_for_gh_release app arg
- Reads current installed version from ~/.appname inside the container
- Queries GitHub API /releases/latest for comparison
- Outputs color-coded status: up-to-date (green), update available (yellow),
  or unknown (blue/yellow with reason)

Non-GitHub sources (Codeberg, custom URLs) are skipped with a notice.
Resource scaling is suppressed entirely during dry-run.

Example usage:
  var_container=all_running var_skip_confirm=yes var_dry_run=yes \
    bash -c "$(curl -fsSL .../update-apps.sh)"

* fix(update-apps): dry-run uses check_for_gh_release args, not Source header

The # Source: header can point to a different repo than what
check_for_gh_release actually queries (e.g. RustDesk uses
lejianwen fork, not official rustdesk repo).

Now parse both app name and source repo directly from the
check_for_gh_release call in the ct script:
  check_for_gh_release "appname" "owner/repo"

Also fix $HOME/.appname path expansion in pct exec context.

* fix issue on clear()

* feat(update-apps): add no-op clear wrapper to PATH for update scripts

Co-authored-by: Copilot <copilot@github.com>

* feat(update-apps): enhance error handling for unattended mode in resource checks

Co-authored-by: Copilot <copilot@github.com>

* feat(update-apps): implement structured logging and summary report for updates

Co-authored-by: Copilot <copilot@github.com>

* fix log issue

Co-authored-by: Copilot <copilot@github.com>

* feat(update-apps): enhance dry-run functionality and logging for container updates

Co-authored-by: Copilot <copilot@github.com>

* feat(update-apps): add dry-run completion message for better user feedback

Co-authored-by: Copilot <copilot@github.com>

---------

Co-authored-by: Copilot <copilot@github.com>

misc/build.func

@@ -3230,6 +3230,10 @@ check_container_resources() {
   if [[ "$current_ram" -lt "$var_ram" ]] || [[ "$current_cpu" -lt "$var_cpu" ]]; then
     msg_warn "Under-provisioned: Required ${var_cpu} CPU/${var_ram}MB RAM, Current ${current_cpu} CPU/${current_ram}MB RAM"
     echo -e "${YWB}Please ensure that the ${APP} LXC is configured with at least ${var_cpu} vCPU and ${var_ram} MB RAM for the build process.${CL}\n"
+    if is_unattended; then
+      msg_error "Aborted: under-provisioned LXC in unattended mode (${current_cpu} CPU/${current_ram}MB RAM < ${var_cpu} CPU/${var_ram}MB RAM)"
+      exit 113
+    fi
     echo -ne "${INFO}${HOLD} May cause data loss! ${INFO} Continue update with under-provisioned LXC? <yes/No>  "
     read -r prompt </dev/tty
     if [[ ! ${prompt,,} =~ ^(yes)$ ]]; then
@@ -3253,6 +3257,10 @@ check_container_storage() {
   usage=$((100 * used_size / total_size))
   if ((usage > 80)); then
     msg_warn "Storage is dangerously low (${usage}% used on /boot)"
+    if is_unattended; then
+      msg_error "Aborted: storage too low in unattended mode (${usage}% used on /boot)"
+      exit 114
+    fi
     echo -ne "Continue anyway? <y/N>  "
     read -r prompt </dev/tty
     if [[ ! ${prompt,,} =~ ^(y|yes)$ ]]; then

misc/core.func

@@ -868,6 +868,12 @@ get_header() {
 # - Returns silently if header not available
 # ------------------------------------------------------------------------------
 header_info() {
+  # Guard against printing the header twice in the same session (e.g. when
+  # the ct script calls header_info at global scope AND again inside
+  # update_script()).
+  [[ "${_HEADER_SHOWN:-0}" == "1" ]] && return 0
+  _HEADER_SHOWN=1
+
   local app_name=$(echo "${APP,,}" | tr -d ' ')
   local header_content