fix: mktemp failure aborts loudly at all three skill-content sites; failed upgrade swap restores the backup (#2679)

An empty $(mktemp) result silently disabled the redaction pass (redact-doc
resolver, ship pr-body) and made /gstack-upgrade's vendored path destructive:
clone lands at "/gstack", the swap mv fails, and rm -rf then deletes BOTH the
live install's backup and "". All three sites now guard the assignment with a
loud exit; the vendored block additionally restores the backup when the swap
fails (same failure class — backup deletion after a failed mv) and the GitLab
MR path sends the SCANNED file's bytes instead of re-rendering an unscanned
heredoc. bin/gstack-redact rejects an explicit empty --from-file path instead
of silently falling through to stdin.

Receipts: 6 of 8 new regression checks fail on a v1.77.0.0 scratch worktree.

Fixes #2679

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/gstack-redact

@@ -123,6 +123,15 @@ function flag(name: string): boolean {
 
 function readInput(): string {
   const file = arg("--from-file");
+  // An explicitly-passed EMPTY path must error, not silently fall through to
+  // stdin: skill blocks pass "$FILE" from a $(mktemp) that may have failed,
+  // and the stdin fallback then scans nothing while looking green (#2679).
+  if (file === "") {
+    process.stderr.write(
+      "gstack-redact: --from-file requires a non-empty path (did mktemp fail?)\n",
+    );
+    process.exit(1);
+  }
   if (file) {
     const st = fs.statSync(file);
     if (st.size > MAX_STDIN_BYTES) {