fix: auto-update never bootstraps missing tools; detect pip via pip3

[CybotTM]

Problem

Running make upgrade (the interactive guide) silently installed pip,
even though pip showed as not installed. Two independent causes:

1. Auto-update bootstrapped missing tools. The global auto_upgrade
   default is true, so every tool without an explicit per-tool setting is
   auto-update-eligible. The guide treated auto_update=true as install or
   upgrade, so an absent tool (pip) was freshly installed rather than skipped.

2. pip was misdetected as absent. The catalog only searched for a bare
   pip binary; systems that expose only pip3 reported pip as not installed,
   which is what triggered the bootstrap in the first place.

Changes

• scripts/guide.sh — the auto-update path now guards on install state:
  if a tool is not installed it is skipped ("upgrades existing tools only"),
  never bootstrapped. Package acquisition stays with uv/bun. Removed the
  now-unreachable fresh-install branch and the SUMMARY_INSTALLED counter it
  was the sole feeder of (interactive installs already count as Updated).
• catalog/pip.json — added "candidates": ["pip", "pip3"] (mirroring
  fd/fdfind) so an existing pip is detected and kept current by
  auto-update.

Net behavior

pip state	before	after
present (as pip3)	reported not-installed	detected, auto-upgraded
absent	auto-installed	skipped

Verification

• pytest: 634 passed, 1 skipped.
• Gating flake8 (E9,F63,F7,F82) clean; smoke test passes; audit.py --help OK.
• bash -n scripts/guide.sh clean; added shell lines are shellcheck-clean.
• Staged a fake pip3 (no bare pip) on PATH + live audit → pip 25.3 -> 26.1.2
  (was not installed before the catalog change).
• test_guide_multi_install.sh: the only 3 failures are pre-existing on
  unmodified main (nvm classification / single-install warning); no regression.

No version bump or CHANGELOG (feature-branch policy).

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[gemini-code-assist]

Code Review

This pull request updates the pip catalog configuration to include alternative binary candidates and refactors the guide.sh script to ensure that the auto-update process only upgrades already installed tools instead of bootstrapping missing ones. Uninstalled tools are now skipped silently during auto-update, and the unused SUMMARY_INSTALLED counter has been removed. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.82%. Comparing base (4a15c28) to head (53acb7e).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #100      +/-   ##
==========================================
- Coverage   69.88%   69.82%   -0.06%     
==========================================
  Files          22       22              
  Lines        3347     3347              
==========================================
- Hits         2339     2337       -2     
- Misses       1008     1010       +2     

Flag	Coverage Δ
unittests	69.82% <ø> (-0.06%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR fixes an unintended behavior in the interactive upgrade guide where auto-update could bootstrap missing tools (notably pip) and also improves pip detection on systems that only expose pip3. This aligns make upgrade with “upgrade existing tools only” semantics while ensuring pip isn’t falsely flagged as absent.

Changes:

• Prevent auto-update in scripts/guide.sh from installing tools that are not already installed (skip instead of bootstrap).
• Simplify/clarify auto-update command construction by defaulting to install_tool.sh <tool> update when applicable and removing the unused “Installed” summary counter.
• Improve pip detection by adding pip3 as an executable candidate in catalog/pip.json.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
scripts/guide.sh	Guards auto-update to only run for already-installed tools; removes now-unused install summary counter.
catalog/pip.json	Adds pip3 as a candidate executable so pip can be detected when only pip3 exists.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.