minify truncates its output file when the template render fails

[fentas]

argsh minify -t <template> -o <out> renders the template with:

```sh
envsubst '$data,$commit_sha,$version' <"${template}" >"${out}"
```

(libraries/main.sh:1563)

Two problems compound:

1. The redirect truncates ${out} before envsubst runs. If the render fails, the previously-good artifact is already destroyed — replaced by a 0-byte file. set -euo pipefail aborts after the damage.

2. envsubst may not be GNU envsubst. renvsubst is a common drop-in (lok8s installs it as envsubst), and it rejects the GNU SHELL-FORMAT positional argument:

   ```
   ERROR: Unknown flag: $data,$commit_sha,$version
   ```

   So a project whose own toolchain is on PATH gets a 0-byte bundle from a build that looks like it merely printed a warning.

This bit us on a published installer: install/build in lok8s writes docs/public/lo-up, which is served directly to curl -fsSL https://get.lok8s.io | sh. A build run with the project's env active silently replaced it with an empty file.

Suggested fix

Render to a temp file and mv on success, so a failed render cannot damage an existing output:

```sh
local tmp; tmp="$(mktemp)"
if ! envsubst '$data,$commit_sha,$version' <"${template}" >"${tmp}"; then
rm -f "${tmp}"
return 1
fi
[[ -s "${tmp}" ]] || { rm -f "${tmp}"; return 1; }
mv "${tmp}" "${out}"
```

Optionally also detect the flavor up front — envsubst --version | grep -q 'GNU gettext' — and fail with a clear message naming the culprit, since "Unknown flag" gives no hint that the wrong envsubst is on PATH.

[fentas]

Fixed in PR #180 (merged).

argsh::minify -t now renders into a mktemp file, checks BOTH the render exit code and that the result is non-empty (-s), and only then moves it over ${out}. Every failure path leaves the previous artifact byte-for-byte intact and says so ("... ; ${out} left untouched"). The /dev/stdout default is handled by a cat branch, since mv cannot replace a non-regular file.

Also implemented the flavor check this issue prescribed: a non-GNU envsubst on PATH is rejected up front with a message naming the fix, which is the exact renvsubst "Unknown flag" shape that empty-bundled lok8s's published lo-up installer.

Review round found one real regression in the fix itself: mv handed ${out} mktemp's 0600 mode, where the old redirect preserved the file's existing permissions. Now chmod --reference the existing file (644 for a new one) before the move, with a permission assertion in the happy-path test.

Tests: 4 new bats cases using fake minifier/envsubst executables on PATH (so they hold against minified argsh too) — happy path with content assertions, failed render preserves content, empty render preserves content, non-GNU envsubst rejected. Both mutations kill-confirmed: restoring the direct redirect fails the two preservation tests; dropping the chmod fails the permission assertion.

Note: the repo's coverage CI job is red on this PR — it is red on #179, #176 and #173 as well (argsh coverage builtin exits 1 in 0.02 s with no output), so it is pre-existing and unrelated. Worth its own issue.