fix(update): type-guard the guidance-hints ledger against corrupted state

A hand-edited ~/.rgit/update-check.json with a non-list guidance_hints made
mark_hint_shown raise AttributeError past installer's (OSError,
UnicodeDecodeError) guard, breaking the module's never-raises contract.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Lum1104

src/rgit/updatecheck.py

@@ -130,13 +130,21 @@ def maybe_start_background_check(now: float) -> None:
     threading.Thread(target=_fetch_once, args=(now,), daemon=True).start()
 
 
+def _hints(state: dict) -> list:
+    # Type-guard like every other reader here: a hand-edited or drifted state
+    # file must degrade to "no hints shown yet", never raise.
+    hints = state.get("guidance_hints")
+    return hints if isinstance(hints, list) else []
+
+
 def hint_pending(path: str) -> bool:
-    return path not in load_state().get("guidance_hints", [])
+    return path not in _hints(load_state())
 
 
 def mark_hint_shown(path: str) -> None:
     state = load_state()
-    hints = state.setdefault("guidance_hints", [])
+    hints = _hints(state)
     if path not in hints:
         hints.append(path)
+        state["guidance_hints"] = hints
         save_state(state)

tests/test_updatecheck.py

@@ -172,3 +172,12 @@ def test_hint_ledger(monkeypatch, tmp_path):
     updatecheck.mark_hint_shown("/x/AGENTS.md")
     assert updatecheck.hint_pending("/x/AGENTS.md") is False
     assert updatecheck.hint_pending("/y/CLAUDE.md") is True
+
+
+def test_hint_ledger_tolerates_corrupt_guidance_hints(monkeypatch, tmp_path):
+    _use_tmp_state(monkeypatch, tmp_path)
+    updatecheck.save_state({"guidance_hints": "corrupt"})
+    assert updatecheck.hint_pending("/x/AGENTS.md") is True
+    updatecheck.mark_hint_shown("/x/AGENTS.md")          # must not raise
+    assert updatecheck.hint_pending("/x/AGENTS.md") is False
+    assert updatecheck.load_state()["guidance_hints"] == ["/x/AGENTS.md"]