Check just update flags before pulling the playbook

`just update` pulled the playbook first and only then looked at its
flags. An unknown flag printed a message and was then passed to agru
anyway, and `-u` without agru was silently ignored.

Both now stop `just update` with an error, before anything is pulled.

The same change in mash-playbook:
https://github.com/mother-of-all-self-hosting/mash-playbook/commit/0598aa82

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

justfile

@@ -26,19 +26,27 @@ roles:
     @{{ just_executable() }} --justfile "{{ justfile() }}" _install-roles
 
 # Updates the playbook and installs the necessary Ansible roles pinned in requirements.yml. If a -u flag is passed, also updates the requirements.yml file with new role versions (if available)
-update *flags: update-playbook-only
+update *flags:
     #!/usr/bin/env sh
     set -eu
-    if [ "{{ flags }}" = "-u" ] && [ -x "$(command -v agru)" ]; then
+    if [ -n "{{ flags }}" ] && [ "{{ flags }}" != "-u" ]; then
+        echo "Unknown flags passed: {{ flags }}" >&2
+        exit 1
+    fi
+    if [ "{{ flags }}" = "-u" ] && ! [ -x "$(command -v agru)" ]; then
+        echo "Updating role versions (-u) requires the agru tool: https://github.com/etkecc/agru#where-to-get" >&2
+        exit 1
+    fi
+
+    {{ just_executable() }} --justfile "{{ justfile() }}" update-playbook-only
+
+    if [ "{{ flags }}" = "-u" ]; then
         # This updates the versions pinned in requirements.yml and installs the roles
         echo "Updating roles and pinning new versions in requirements.yml…"
         agru -p roles/galaxy/ -no-tui -u
-        exit 0
+    else
+        {{ just_executable() }} --justfile "{{ justfile() }}" _install-roles
     fi
-    if [ -n "{{ flags }}" ]; then
-        echo "Ignoring unsupported flags: {{ flags }}"
-    fi
-    {{ just_executable() }} --justfile "{{ justfile() }}" _install-roles
 
 # Updates the playbook without installing/updating Ansible roles
 update-playbook-only: