fix: improve pnpm hash extraction + log oracle build output on failure

cmd/update-tools/main.go

@@ -200,7 +200,15 @@ func updateOracle(repoRoot string) error {
 	logText, buildErr := internal.NixBuildOracle()
 	pnpmHash := internal.ExtractGotHash(logText)
 	if pnpmHash == "" {
+		// Restore original file so we don't leave a broken placeholder hash behind.
 		_ = os.WriteFile(oracleFile, orig, 0644)
+		// Surface some context in CI logs. This is usually a hash-mismatch line we failed to parse.
+		lines := strings.Split(logText, "\n")
+		start := 0
+		if len(lines) > 200 {
+			start = len(lines) - 200
+		}
+		log.Printf("[update-tools] oracle build output (last %d lines):\n%s", len(lines)-start, strings.Join(lines[start:], "\n"))
 		return fmt.Errorf("oracle pnpm hash not found (build err: %v)", buildErr)
 	}
 	if err := internal.ReplaceOnceFunc(oracleFile, pnpmRe, func(s string) string {

internal/nix.go

@@ -88,7 +88,10 @@ func NixBuildSummarizeSystem(system string) (string, error) {
 }
 
 func ExtractGotHash(log string) string {
-	re := regexp.MustCompile(`got:\s*(sha256-[A-Za-z0-9+/=]+)`)
+	// Nix typically prints something like:
+	//   got:    sha256-....
+	// but sometimes wraps/indents. Keep this forgiving.
+	re := regexp.MustCompile(`(?i)got:\s*"?(sha256-[A-Za-z0-9+/=]+)"?`)
 	for _, line := range strings.Split(log, "\n") {
 		match := re.FindStringSubmatch(line)
 		if len(match) > 1 {