GitOps: --dry-run reports success on invalid scripts when the fleet doesn't exist yet #58745

Fleet versions

• Discovered: main (d7dbd06)
• Reproduced: rc-minor-fleet-v4.95.0 (20e1bbb)

Web browser and operating system: N/A (fleetctl gitops)

💥 Actual behavior

fleetctl gitops --dry-run doesn't validate scripts when the fleet named in the file doesn't exist yet. A script with an unsupported interpreter passes the dry run (would've applied 1 script, gitops dry run succeeded, exit 0). The real apply then rejects it, after it has already created the fleet.

When the fleet already exists, the same file fails the dry run with Interpreter not supported.

🛠️ Expected behavior

The dry run validates scripts whether or not the fleet exists yet, as it does for software since #55087.

🧑‍💻 Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.
• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. Create lib/unsupported.sh:

#!/usr/bin/perl
print "hello";

2. Create new-fleet.yml, naming a fleet that doesn't exist:

name: dry-run-script-gap
controls:
  scripts:
    - path: lib/unsupported.sh

3. fleetctl gitops -f new-fleet.yml --dry-run → would've applied 1 script, gitops dry run succeeded, exit 0.
4. fleetctl gitops -f new-fleet.yml → Validation Failed: Interpreter not supported, exit 1. The fleet dry-run-script-gap now exists.

🕯️ More info

Same cause as #54534: on a dry run, the scripts batch returns as soon as the fleet isn't found (if dryRun && fleet.IsNotFound(err) { return nil, nil }, server/service/scripts.go), before ValidateNewScript and the Fleet variable check run. #55087 fixed this for software only. Its description notes the same early return in the scripts batch and in app store apps (ee/server/service/vpp.go, categories), and offers a follow-up.

Also present in fleet-v4.94.1.