fix: run git pull first in update.sh, not mid-script

Real failure on the server after #47 merged: the old GID-resolution
code ran (found the old COMFYUI_VIDEO_GID/COMFYUI_RENDER_GID vars
"already set"), then git pull swapped every file on disk out from
under the still-running script — including docker-compose.yml, now
requiring HOST_VIDEO_GID/HOST_RENDER_GID — but the resolution step
that would populate those had already run under the old code and
never re-ran. compose validation then failed on the new required
vars that were never set.

A self-updating script isn't atomic against its own file changing
mid-run. Move git pull to the very first thing the script does, so
every run is consistently either fully old or fully new code, never
a mix.

bash -n and docker compose config -q both validated.

scripts/update.sh

@@ -14,6 +14,17 @@
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
+# Must run before anything else touches a file this script itself reads
+# (docker-compose.yml, .env.example, this script's own remaining lines) —
+# a self-updating script isn't guaranteed atomic against its own file
+# changing mid-run, so pulling later can execute a mix of old and new
+# script/compose content in one pass. Bit us for real: old GID-resolution
+# code ran, then this pulled in new var names docker-compose.yml now
+# requires, and nothing re-ran the (now-current) resolution step for
+# them — see issue #5's thread.
+echo "==> git pull"
+git pull --ff-only
+
 [ -f .env ] || cp .env.example .env
 
 # Handles all three cases: the KEY=value line is missing entirely (.env
@@ -81,9 +92,6 @@ else
   echo "HOST_RENDER_GID: no 'render' group on this host, set it manually if still blank."
 fi
 
-echo "==> git pull"
-git pull --ff-only
-
 echo "==> validating compose config"
 docker compose config -q