fix: validate descriptor root is dict, add shared infra to upgrade

- Add isinstance(self.data, dict) check at start of _validate() so
  non-mapping YAML roots raise IntegrationDescriptorError
- Run _install_shared_infra() and ensure_executable_scripts() in
  upgrade command to match install/switch behavior

Author: mnriem

src/specify_cli/__init__.py

@@ -2286,6 +2286,12 @@ def integration_upgrade(
 
     selected_script = _resolve_script_type(project_root, script)
 
+    # Ensure shared infrastructure is present (safe to run unconditionally;
+    # _install_shared_infra merges missing files without overwriting).
+    _install_shared_infra(project_root, selected_script)
+    if os.name != "nt":
+        ensure_executable_scripts(project_root)
+
     # Phase 1: Install new files (overwrites existing; old-only files remain)
     console.print(f"Upgrading integration: [cyan]{key}[/cyan]")
     new_manifest = IntegrationManifest(key, project_root, version=get_speckit_version())

src/specify_cli/integrations/catalog.py

@@ -449,6 +449,10 @@ def _load(path: Path) -> dict:
     # -- Validation -------------------------------------------------------
 
     def _validate(self) -> None:
+        if not isinstance(self.data, dict):
+            raise IntegrationDescriptorError(
+                f"Descriptor root must be a YAML mapping, got {type(self.data).__name__}"
+            )
         for field in self.REQUIRED_TOP_LEVEL:
             if field not in self.data:
                 raise IntegrationDescriptorError(