scripts/update-stack.sh checks stack folders that were copied out of a clone
against the latest version in the repository and updates them with a
three-way merge, so edits to .env and compose.yaml survive. It reads the
upstream files with git only, never prints .env values, makes a backup
before it writes, and never restarts containers.

scripts/test-update-stack.sh tests it against a throwaway repository, and a
new workflow runs ShellCheck and the test on changes to scripts/.

Download the service from GitHub instead of reading a full clone, and
update compose.yaml and .env with a three-way merge against the upstream
files that the last run saved in .scaletail/. This drops the base
detection, the marker commit, --base, --ref and --no-fetch.

- The first run replaces compose.yaml with a backup, and adds missing
  .env variables.
- A conflict writes markers into the file, after a backup, and the next
  run refuses until they are resolved.
- Target bash and GNU tools on Linux, not bash 3.2 and BSD.

The first update printed a unified diff of compose.yaml. Comment and
context lines hid the settings that changed. Print a short overview:
one line per changed setting, and a single line when only comments differ.

The overview of the first update still printed many lines for an old
stack: fragments of the serve config, keys without their service, and
values such as an auth key that old stacks set in compose.yaml. Print
one label instead: settings differ, or only comments or spacing. After
--apply, print the diff command that compares the backup with the new
file. The script now prints no contents of compose.yaml or .env.