fix(hack): verify mikefarah yq in promote-retag

Address review feedback from gemini-code-assist on hack/promote-retag.sh:27: command -v yq only confirms some yq is on PATH; the script's queries use mikefarah syntax, so reject python-yq and other variants by checking the version string, mirroring the Makefile build-deps check.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>

hack/promote-retag.sh

@@ -24,6 +24,9 @@ DRY_RUN=0
 [ "${2:-}" = "--dry-run" ] && DRY_RUN=1
 
 command -v yq >/dev/null     || { echo "yq (mikefarah) is required" >&2; exit 1; }
+# The queries below use mikefarah syntax; reject python-yq and other variants
+# (mirrors the build-deps check in the Makefile).
+yq --version 2>&1 | grep -q mikefarah || { echo "yq (mikefarah) is required" >&2; exit 1; }
 command -v skopeo >/dev/null || { echo "skopeo is required" >&2; exit 1; }
 
 # Collect "repo@sha256:..." refs from every package values.yaml, across the