Fix website render parse failure

apps/website/lang/en.php

@@ -150,7 +150,7 @@ return [
     'blog_stack_16'          => 'The monitoring layer now includes Prometheus Stack, Grafana, Loki, Promtail, node-exporter, and kube-state-metrics, with placement guardrails so platform add-ons stop defaulting to the control plane.',
     'blog_stack_17'          => 'The portfolio website keeps Apache at the core, runs PHP through PHP-FPM with OPcache, pre-renders read-heavy pages into static HTML during the image build, and leaves PHP for write and translation endpoints.',
     'blog_stack_18'          => 'The supply-chain path now uses BuildKit SBOM attestations, Cosign signatures, a cluster-published public key, and an audit-first Kyverno ImageValidatingPolicy that can be promoted to deny unsigned local-registry pods.',
-    'blog_stack_19'          => 'The translation path now uses Redis for per-string cache hits, a custom Ollama website-translator model on the Debian server for cache misses, n8n for prewarming and batch workflow automation, and structured logs for cache, latency, JSON parse, and timeout signals.',
+    'blog_stack_19'          => 'The translation path now uses Redis for per-string cache hits, a custom Ollama website-translator model on the Debian server for cache misses, n8n for prewarming and batch workflow automation, and structured logs for cache, latency, JSON parse, and timeout signals.',
     'blog_arch_kicker'       => 'Architecture map',
     'blog_arch_title'        => 'The homelab, end to end',
     'blog_arch_intro'        => 'The current delivery path starts with a push to Gitea, runs local validation, builds arm64 images, syncs the validated commit into the GitOps mirror, and lets Argo CD reconcile from the app workers. The infrastructure path stays manual through jeannie, including the PXE/Pimox template builder, NVMe-backed worker clones, Kyverno policy placement, Redis-backed website translation, n8n workflow automation, and the opt-in OpenWrt firewall VM, while the OCI edge routes public traffic back through the private path.',

apps/website/lang/nah.php

@@ -150,7 +150,7 @@ return [
     'blog_stack_16'          => 'Monitoring layer axcan includes Prometheus Stack, Grafana, Loki, Promtail, node-exporter, ihuan kube-state-metrics, ika placement guardrails para platform add-ons ma amo default to control plane.',
     'blog_stack_17'          => 'Portfolio website keeps Apache at core, runs PHP through PHP-FPM ika OPcache, pre-renders read-heavy pages into static HTML during image build, ihuan leaves PHP para write ihuan translation endpoints.',
     'blog_stack_18'          => 'Supply-chain path axcan uses BuildKit SBOM attestations, Cosign signatures, public key ipan cluster, ihuan audit-first Kyverno ImageValidatingPolicy in huel mopromote para deny unsigned local-registry pods.',
-    'blog_stack_19'          => 'Translation path axcan uses Redis para per-string cache hits, custom Ollama website-translator model ipan Debian server para cache misses, n8n para prewarming ihuan batch workflows, ihuan structured logs para cache, latency, JSON parse, ihuan timeout signals.',
+    'blog_stack_19'          => 'Translation path axcan uses Redis para per-string cache hits, custom Ollama website-translator model ipan Debian server para cache misses, n8n para prewarming ihuan batch workflows, ihuan structured logs para cache, latency, JSON parse, ihuan timeout signals.',
     'blog_arch_kicker'       => 'Architecture mapa',
     'blog_arch_title'        => 'Homelab, end to end',
     'blog_arch_intro'        => 'Current delivery path starts ika push to Gitea, runs local validation, builds arm64 images, syncs validated commit into GitOps mirror, ihuan lets Argo CD reconcile from app workers. Infrastructure path stays manual through jeannie, including PXE/Pimox template builder, NVMe-backed worker clones, Kyverno policy placement, Redis-backed website translation, n8n workflow automation, ihuan opt-in OpenWrt firewall VM, while OCI edge routes public traffic back through private path.',

apps/website/render-static-pages.sh

@@ -22,9 +22,10 @@ render_page() {
     include $argv[5] . "/" . $argv[4];
   ' "lang=$lang" "$lang" "$request_uri" "$source" "$root" > "$output"; then
     return 0
+  else
+    status=$?
   fi
 
-  status=$?
   echo "Failed rendering ${source} (${lang}) with exit status ${status}" >&2
   rm -f "$output"
   return "$status"

lib/jeannie/pipeline.sh

@@ -3290,22 +3290,27 @@ EOF
 ensure_cosign_available() {
     local arch
     local cosign_url
+    local discovered_bin
     local target_dir
     local target_path
     local tmp_path
 
     if [[ -n "${COSIGN_BIN}" ]]; then
-        if [[ -x "${COSIGN_BIN}" ]]; then
+        if [[ -x "${COSIGN_BIN}" ]] && "${COSIGN_BIN}" version >/dev/null 2>&1; then
             return 0
         fi
-        echo "COSIGN_BIN points to ${COSIGN_BIN}, but it is not executable." >&2
+        echo "COSIGN_BIN points to ${COSIGN_BIN}, but it is not executable or crashes when run." >&2
         exit 1
     fi
 
     if command -v cosign >/dev/null 2>&1; then
-        COSIGN_BIN="$(command -v cosign)"
+        discovered_bin="$(command -v cosign)"
+        if "${discovered_bin}" version >/dev/null 2>&1; then
+            COSIGN_BIN="${discovered_bin}"
             return 0
         fi
+        echo "Ignoring system Cosign at ${discovered_bin} because it failed a version check." >&2
+    fi
 
     case "$(uname -m)" in
         x86_64 | amd64)
@@ -3323,9 +3328,13 @@ ensure_cosign_available() {
     target_dir="${HOMELAB_STATE_DIR}/bin"
     target_path="${target_dir}/cosign-v${COSIGN_VERSION}-linux-${arch}"
     if [[ -x "${target_path}" ]]; then
+        if "${target_path}" version >/dev/null 2>&1; then
             COSIGN_BIN="${target_path}"
             return 0
         fi
+        echo "Removing cached Cosign at ${target_path} because it failed a version check." >&2
+        rm -f "${target_path}"
+    fi
 
     if ! command -v curl >/dev/null 2>&1; then
         echo "curl is required to download Cosign ${COSIGN_VERSION}." >&2
@@ -3339,6 +3348,10 @@ ensure_cosign_available() {
     curl -fsSL "${cosign_url}" -o "${tmp_path}"
     chmod 0755 "${tmp_path}"
     mv "${tmp_path}" "${target_path}"
+    if ! "${target_path}" version >/dev/null 2>&1; then
+        echo "Downloaded Cosign ${COSIGN_VERSION} to ${target_path}, but it failed a version check." >&2
+        exit 1
+    fi
     COSIGN_BIN="${target_path}"
 }