CI: Improve safety of update required checks script

[henrymercer]

Fix an error condition that could cause the set of required checks to be emptied.

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.

[Copilot]

Pull Request Overview

This PR improves the safety of the update required checks script by adding error handling to prevent dangerous scenarios where the required checks list could be emptied. The changes add strict error handling and validation to ensure the script fails gracefully when no checks are found.

Key changes:

• Added strict error handling with set -euo pipefail
• Added validation to prevent updating with empty checks list

[mbg]

Copilot's suggestion is probably more robust, but I have no strong feelings about that as this is a good improvement as-is.