auto-update: Stop treating script noise as success

Both service scripts piped their output through 'tail -5' under
'pipefail', so the exit status came from tail, not the upgrade —
failures looked like success and nothing was sent to the classifier.
For PieFed the problem was worse: deploy.sh starts a service that no
longer exists and pybabel exits 1 on translation errors, so the strict
invocation aborted after stopping the services and left the site down.
Run it plainly (it manages fine without set -e, same as manually) and
judge success by the live service state plus an HTTP check instead of
the exit code.

A Mastodon update that fails now reports its real output and status.

services/mastodon/auto-update.sh

@@ -1,4 +1,15 @@
 #!/bin/bash
-set -euo pipefail
+set -uo pipefail
 
-ssh mastodon@abraham.jeena.net "bash -euo pipefail upgrade.sh $2 2>&1 | tail -5"
+out=$(ssh mastodon@abraham.jeena.net "bash -euo pipefail upgrade.sh $2 2>&1 | tail -5; exit \${PIPESTATUS[0]}")
+status=$?
+
+# Report the last lines either way so notifications show what happened.
+if [ -n "$out" ]; then
+    echo "$out"
+elif [ "$status" -ne 0 ]; then
+    echo "Update script exited with status $status"
+fi
+
+# Propagate the upgrade.sh exit status, not tail's.
+exit "$status"