feat: pin vantage-shared v0.5.0, add package-manager output tail buffer

internal/updates/tailbuf.go

@@ -0,0 +1,34 @@
+package updates
+
+import "sync"
+
+// outputTailMax bounds the package-manager output carried back in a
+// PatchResult. The end of the output is where apt and dnf say what failed, so
+// the newest bytes are the ones kept.
+const outputTailMax = 64 << 10
+
+// tailBuffer is an io.Writer that retains only the last max bytes written.
+// Stdout and stderr are both pointed at one, so it is safe for concurrent use.
+type tailBuffer struct {
+	mu  sync.Mutex
+	max int
+	buf []byte
+}
+
+func newTailBuffer(max int) *tailBuffer { return &tailBuffer{max: max} }
+
+func (t *tailBuffer) Write(p []byte) (int, error) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	t.buf = append(t.buf, p...)
+	if over := len(t.buf) - t.max; over > 0 {
+		t.buf = append([]byte(nil), t.buf[over:]...)
+	}
+	return len(p), nil
+}
+
+func (t *tailBuffer) String() string {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	return string(t.buf)
+}