kbagent: add an automated test for the ai-kit-marketplace sync job

[soustruh]

Tracked in Linear: CLI-3

Follow-up from the review of #627. This covers review point 2 only. The doctor legacy-newer edge case (review point 1) stays on the #627 thread.

Context

#627 adds the ai-kit-marketplace job to .github/workflows/release-kbagent.yml. On every stable tag the job rewrites the kbagent entry's version and source.ref in keboola/ai-kit, then opens a PR there.

Gap

That logic has no automated test. It is the only new code that writes to another repo. Today only manual checks cover it. A change to ai-kit's marketplace.json shape would show up at release time, which is the worst time to find it.

The logic to cover:

• the value-compare that makes the job a no-op when the entry already names the tag
• the jq rewrite of version and source.ref
• the guard for a missing file
• the guard for a missing kbagent entry
• the guard for a source that is not a git-subdir, where the rewrite changes nothing

Scope

1. Move the jq rewrite and the value-compare into a small script that a test can call. The workflow step then calls that script.
2. Add a shell or pytest test with these cases:
   • entry already at the target tag: no change, no PR
   • entry at an older tag: version and source.ref both move to the new tag
   • file absent: the error names the file
   • kbagent entry absent: the error names the entry
   • source without a ref: the guard fails and the job stops
3. Run the test in the per-PR CI job, not only at release.