puppet: install toml into the puppetserver gem path

Server-side functions run in the puppetserver JRuby, whose gem path is
separate from the agent CRuby one, so catalog compiles fail with
`LoadError: no such file to load -- toml`.

- Install toml via `puppetserver gem`, matching the puppetserver_gem
  resource in puppet-prod's profiles::puppet::gems
- Report each failed gem install to stderr instead of exiting silently
- Keep the hook exiting zero: the entrypoint runs post-startup hooks
  under errexit, where a non-zero exit kills a serving compiler

apps/base/puppet/resources/additional-ruby-gems.sh

@@ -1,9 +1,29 @@
 #!/bin/bash
-set -e
+# No `set -e`: the entrypoint runs post-startup hooks under errexit, so a non-zero
+# exit here kills an already-serving compiler. Failures are logged, not fatal.
+set -uo pipefail
+
+rc=0
+
+install_gem() {
+  local label=$1
+  shift
+  if ! "$@"; then
+    echo "ERROR: ${label} gem install failed: $*" >&2
+    rc=1
+  fi
+}
 
 echo "Installing additional Ruby gems..."
-/opt/puppetlabs/puppet/bin/gem install deep_merge
+for gem in deep_merge ipaddr hiera-eyaml toml; do
-/opt/puppetlabs/puppet/bin/gem install ipaddr
+  install_gem agent /opt/puppetlabs/puppet/bin/gem install "$gem"
-/opt/puppetlabs/puppet/bin/gem install hiera-eyaml
+done
-/opt/puppetlabs/puppet/bin/gem install toml
+
-echo "Additional Ruby gems installed successfully"
+# Server-side functions load from the puppetserver JRuby gem path, not the agent one.
+install_gem puppetserver /opt/puppetlabs/bin/puppetserver gem install toml
+
+if [ "$rc" -ne 0 ]; then
+  echo "ERROR: additional Ruby gems incomplete; catalog compiles may fail" >&2
+else
+  echo "Additional Ruby gems installed successfully"
+fi