Build shairport-sync 4.3.7 from its tag

The task passed the script `${shairport_sync_version}` - shell syntax in a Jinja field,
and the wrong variable name - which the Pi's shell expanded to nothing, so the script
fell back to its own default. Its `git reset` then ran outside the fresh clone, failed,
and was ignored without `set -e`: every build was simply upstream master. The script
now takes `pi_shairport_sync_version`, requires the argument, clones that tag directly
and stops on the first error. Bumped to 4.3.7.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/pi_shairport/defaults/main.yml

@@ -1,3 +1,3 @@
 ---
-pi_shairport_sync_version: "3.3.5"
+pi_shairport_sync_version: "4.3.7"
 pi_shairport_name: Unnamed Raspberry with shairport

roles/pi_shairport/files/build-shairport-sync.sh

@@ -1,15 +1,14 @@
 #!/bin/bash
+set -e
 
-ARG1=$1
-VERSION=${ARG1:="3.3.6"}
+VERSION=${1:?usage: build-shairport-sync.sh <git tag>}
 
 # Make a new temporary directory and go there
 tmp_dir=$(mktemp -d)
-cd $tmp_dir
+cd "$tmp_dir"
 
-# Clone, build and install
-git clone https://github.com/mikebrady/shairport-sync.git
-git reset --hard origin/$VERSION
+# Clone the requested tag, build and install
+git clone --depth 1 --branch "$VERSION" https://github.com/mikebrady/shairport-sync.git
 cd shairport-sync
 autoreconf -fi
 ./configure --sysconfdir=/etc --with-alsa --with-soxr --with-avahi --with-ssl=openssl --with-systemd
@@ -18,4 +17,4 @@ make install
 
 # Clean up
 cd ~
-rm -rf $tmp_dir
+rm -rf "$tmp_dir"

roles/pi_shairport/tasks/main.yml

@@ -12,7 +12,7 @@
           'libavahi-client-dev', 'libssl-dev', 'libsoxr-dev']
          + (['systemd-dev'] if ansible_facts.distribution_major_version | int >= 13 else []) }}
 - name: Build and Install Shairport sync (may take a while)
-  ansible.builtin.script: "build-shairport-sync.sh ${shairport_sync_version}"
+  ansible.builtin.script: "build-shairport-sync.sh {{ pi_shairport_sync_version }}"
   args:
     # The unit file rather than the binary: make install puts the binary in place
     # first, so a build that failed halfway would otherwise never be retried.