fix: check yq fallback dependencies in preflight

[luohui1]

Summary

• Fail preflight early when the yq binary is absent and the Python yq-shim fallback cannot run.
• Keep EVAL_SKIP_AUTH_CHECK=1 limited to the credential probe, after local dependency checks still run.
• Add regression coverage for missing python3, missing PyYAML, a working Python fallback, and a real yq binary path.

Fixes #3

Tests

• bash -n scripts/eval/lib/preflight.sh scripts/eval/tests/preflight_yq_deps.sh
• bash scripts/eval/tests/preflight_yq_deps.sh
• for t in scripts/eval/tests/*.sh; do bash "$t"; done (21 shell tests, with jq 1.7.1 on PATH)

[gemini-code-assist]

Code Review

This pull request adds a preflight check to verify that either the 'yq' binary is available or the Python 'yq-shim' fallback (requiring 'python3' and 'pyyaml') can run, preventing silent failures later. It also includes a new test script to validate these checks. The feedback suggests a minor improvement in the test script's exit trap to safely handle unbound variables under 'set -u' if the temporary directory creation fails.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Under set -euo pipefail (line 2), referencing an unbound variable causes the shell to exit with an error. If mktemp on line 7 fails, the WORK variable will remain unbound when the EXIT trap runs, causing the trap itself to fail with an unbound variable error. Using the parameter expansion ${WORK:-} safely defaults to an empty string if WORK is unbound or empty, preventing this error.

Suggested change

	trap 'rm -rf "$WORK"' EXIT
	trap 'rm -rf "${WORK:-}"' EXIT