the chart-version reader stays inside the block it is written in

The step embedded multi-line Python at column zero — a heredoc terminator in
one repo, an inline -c script in the other — and both dedented straight out of
the run: block scalar, so the workflow did not parse as YAML at all and the
job it belongs to could never start.

It is one indented line now. The lookup is unchanged: read the ApplicationSet,
find the source whose chart is app, print its repository and target revision.
A missing source raises instead of returning nothing, which is the point of
parsing the document rather than grepping it — the comment above already said
a silent miss renders against whatever the registry calls latest.

.hanzo/workflows/cicd.yml

@@ -35,14 +35,7 @@ jobs:
           # Parsed as YAML, not grepped: `targetRevision` sits several keys below
           # `chart:`, so a line-window match silently returns nothing and the
           # check then renders against whatever the registry calls latest.
-          eval "$(python3 -c '
-import yaml
-d = yaml.safe_load(open("deploy/applicationset.yaml"))
-for s in d["spec"]["template"]["spec"]["sources"]:
-    if s.get("chart") == "app":
-        print(f"CHART=oci://{s[\"repoURL\"]}/app")
-        print(f"VERSION={s[\"targetRevision\"]}")
-')"
+          eval "$(python3 -c 'import yaml; d = yaml.safe_load(open("deploy/applicationset.yaml")); s = next(x for x in d["spec"]["template"]["spec"]["sources"] if x.get("chart") == "app"); print("CHART=oci://%s/app" % s["repoURL"]); print("VERSION=%s" % s["targetRevision"])')"
           echo "chart ${CHART:?} version ${VERSION:?}"
 
           fail=0