[malept]

What this PR does / why we need it

Follow-up to getoutreach/devbase#1252, which added a gojq fallback to yq_wrapper and shell/yq.sh for jobs without Go. shell/lib/box.sh and shell/devconfig.sh call yq_resolve_bin directly, and it still ran go build on an unstable devbase version. Jobs without Go, which for example ran ci/release/docker-authn.sh as one of the steps, failed with "failed to build devbase". yq_resolve_bin now returns early when yq_wrapper will run gojq instead.

Notes for your reviewers

Tagged releases are unaffected: they use a downloaded binary, and a test covers a tagged version without Go. Without Go, yq_resolve_bin caches nothing, so each yq_wrapper call repeats the cheap yq_use_gojq check.

The fallback is silent. A warning when it runs gojq would be noisy while many callers still run shell/yq.sh as a separate process. It can be added in yq_run_gojq once those calls move to yq_wrapper.

Rejected review findings

These findings were reviewed and rejected. Do not raise them again unless the code changes in a way that affects them.

• yq_use_gojq runs twice per yq_wrapper call, and the version lookup repeats. The check is a file read and a command -v. Sharing the result needs a larger redesign for little gain.
• The gojq decision is made in shell/yq.sh, yq_wrapper and yq_resolve_bin; use a single resolver. A single resolver is a reasonable refactor but out of scope for this fix.
• The existing yq_wrapper test stubs yq_resolve_bin to fail, so it is redundant. It still shows that yq_wrapper returns before it resolves.
• The yq_resolve_bin local/dev test needs a find_tool stub. The stub keeps the test from depending on whether Go is installed.
• find_tool go can find a mise-managed Go that is not on PATH, while the build runs a bare go. Mise-managed Go will be on PATH, so the check and the build agree.
• find_tool gojq can print "mise not found" to stderr. A fatal error follows it, so the message is not extra noise.

---

Generated by Claude Code