- refresh_os_packages()'s header claimed it was callable both host-side (via
pct exec) and inside the LXC; it's a plain bash function in this process,
it cannot cross a pct exec boundary. Corrected to match the comment
already present at its one host-side non-call-site in openbao/install.sh.
- Removed `set -euo pipefail`: a sourced file must not impose shell options
on the caller. Both install scripts already set these before sourcing.
- Added ensure_template_present(), ported from openbao/install.sh, so
gitea-runner can reuse it (issue #12 follow-up) instead of duplicating a
template-download check that skipped `pveam update` and could silently
settle for a stale cached template list.
Damien