Update script needs to bootstrap itself before executing

[jleibs]

Currently when updating, we invoke an arbitrarily old version of the script, which fetches content from the head of the template repo, but compares it with path-filters in the old version of the script.

This generally means we need to run the script twice (once to update itself, possibly with the wrong sets of inclusions/exclusions), and a second time to end up in the correct state.

The script should do something like boot-strap itself, and then re-invoke if the contents have changed.