fix: mktemp failure aborts loudly at all three skill-content sites; failed upgrade swap restores the backup (#2679)

An empty $(mktemp) result silently disabled the redaction pass (redact-doc
resolver, ship pr-body) and made /gstack-upgrade's vendored path destructive:
clone lands at "/gstack", the swap mv fails, and rm -rf then deletes BOTH the
live install's backup and "". All three sites now guard the assignment with a
loud exit; the vendored block additionally restores the backup when the swap
fails (same failure class — backup deletion after a failed mv) and the GitLab
MR path sends the SCANNED file's bytes instead of re-rendering an unscanned
heredoc. bin/gstack-redact rejects an explicit empty --from-file path instead
of silently falling through to stdin.

Receipts: 6 of 8 new regression checks fail on a v1.77.0.0 scratch worktree.

Fixes #2679

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/regression-pr1169-mktemp-fallbacks.test.ts

@@ -56,6 +56,77 @@ describe("PR #1169 bug #4: gstack-telemetry-sync mktemp fallback", () => {
   });
 });
 
+// #2679: three skill-content mktemp sites ran unguarded. An empty result
+// ("" on mktemp failure) silently disabled the redaction pass (redact-doc
+// resolver + ship pr-body) and — the destructive one — made /gstack-upgrade's
+// vendored path clone to "/gstack", fail the swap, then `rm -rf` BOTH the
+// live install's backup and "". Guards must abort loudly; the upgrade block
+// must also restore the backup when the swap fails (same failure class:
+// backup deletion after a failed mv).
+describe("#2679: skill-content mktemp guards", () => {
+  test("redact-doc resolver guards REDACT_FILE=$(mktemp) with a loud exit", () => {
+    // The guard line contains a ${sink.noun} interpolation in the resolver
+    // source, so match to end-of-line rather than [^}]* (which stops at the
+    // interpolation's closing brace).
+    const body = readScript("scripts/resolvers/redact-doc.ts");
+    expect(body).toMatch(/REDACT_FILE=\$\(mktemp\)\s*\|\|\s*\{.*exit 1/);
+    // And the rendered output (interpolation resolved) carries the guard too.
+    const rendered = readScript("spec/sections/gate-and-file.md");
+    expect(rendered).toMatch(/REDACT_FILE=\$\(mktemp\)\s*\|\|\s*\{[^}]*exit 1/);
+  });
+
+  test("ship pr-body template guards PR_BODY_FILE=$(mktemp) with a loud exit", () => {
+    const body = readScript("ship/sections/pr-body.md.tmpl");
+    expect(body).toMatch(/PR_BODY_FILE=\$\(mktemp\)\s*\|\|\s*\{[^}]*exit 1/);
+  });
+
+  test("ship pr-body GitLab path sends the SCANNED file, never a re-rendered heredoc", () => {
+    const body = readScript("ship/sections/pr-body.md.tmpl");
+    expect(body).toContain('-d "$(cat "$PR_BODY_FILE")"');
+    expect(body).not.toMatch(/glab mr create[^\n]*-d "\$\(cat <<'EOF'/);
+  });
+
+  test("gstack-upgrade vendored block guards mktemp -d and clone with loud aborts", () => {
+    const body = readScript("gstack-upgrade/SKILL.md.tmpl");
+    expect(body).toMatch(/TMP_DIR=\$\(mktemp -d\)\s*\|\|\s*\{[^}]*exit 1/);
+    expect(body).toMatch(/git clone[^\n]*\|\|\s*\{[^}]*exit 1/);
+  });
+
+  test("gstack-upgrade vendored block restores the backup on a failed swap (no unconditional backup rm)", () => {
+    const body = readScript("gstack-upgrade/SKILL.md.tmpl");
+    expect(body).toMatch(/if mv "\$TMP_DIR\/gstack" "\$INSTALL_DIR"; then/);
+    expect(body).toMatch(/mv "\$INSTALL_DIR\.bak" "\$INSTALL_DIR"/);
+    // The backup rm must live inside the success branch, not after the block.
+    const block = body.slice(body.indexOf('if mv "$TMP_DIR/gstack"'));
+    const successRm = block.indexOf('rm -rf "$INSTALL_DIR.bak"');
+    const elseBranch = block.indexOf("else");
+    expect(successRm).toBeGreaterThan(-1);
+    expect(successRm).toBeLessThan(elseBranch);
+  });
+
+  test("runtime: the guarded assignment aborts when mktemp fails", () => {
+    const { spawnSync } = require("node:child_process") as typeof import("node:child_process");
+    const script = `mktemp() { return 1; }
+TMP_DIR=$(mktemp -d) || { echo "ERROR: mktemp failed — aborting upgrade (install untouched)." >&2; exit 1; }
+echo "SHOULD NOT REACH: $TMP_DIR"`;
+    const r = spawnSync("bash", ["-c", script], { encoding: "utf-8", timeout: 10_000 });
+    expect(r.status).toBe(1);
+    expect(r.stderr).toContain("mktemp failed");
+    expect(r.stdout).not.toContain("SHOULD NOT REACH");
+  });
+
+  test("runtime: gstack-redact --from-file '' errors loudly instead of falling through to stdin", () => {
+    const { spawnSync } = require("node:child_process") as typeof import("node:child_process");
+    const r = spawnSync(
+      "bun",
+      [path.join(ROOT, "bin", "gstack-redact"), "--from-file", "", "--json"],
+      { encoding: "utf-8", input: "sk-ant-api03-not-really-a-key", timeout: 15_000 },
+    );
+    expect(r.status).toBe(1);
+    expect(r.stderr).toContain("non-empty path");
+  });
+});
+
 describe("PR #1169 bug #5: supabase/verify-rls.sh mktemp fallback", () => {
   const SCRIPT = "supabase/verify-rls.sh";