fix(minify): failed render must not truncate the existing output

[fentas]

Fixes #178

Problem

argsh minify -t <template> -o <out> rendered the template with a direct redirect:

envsubst '$data,$commit_sha,$version' <"${template}" >"${out}"

The shell opens and truncates ${out} before envsubst runs, so a failed render destroys a previously-good artifact and leaves a 0-byte file behind. This shipped an empty lo-up installer once (lok8s install/build writes docs/public/lo-up, served to curl | sh).

Fix

• Render into a mktemp file first, verify the render exit code AND that the render is non-empty (-s), only then mv over ${out}. For non-regular targets (the /dev/stdout default), cat instead of mv.
• On failure the temp file is cleaned up by the existing subshell EXIT trap, ${out} is left untouched, and the error names what failed and states that the output was preserved.
• Detect non-GNU envsubst drop-ins up front (envsubst --version | grep -q "GNU gettext"). renvsubst — which lok8s installs as envsubst — rejects the GNU SHELL-FORMAT positional with ERROR: Unknown flag, which gave no hint that the wrong binary was on PATH. The check fails early naming the culprit and the next action (install gettext or fix PATH). This was the issue's optional second suggestion; implemented since it is small and prescribed.

Tests

Four new bats tests in libraries/main.bats, using fake minifier/envsubst executables on PATH (not function stubs, so they also hold against the minified argsh):

• happy path: template render writes the output
• failed render: command fails, pre-existing output keeps its original content
• empty render: command fails, pre-existing output keeps its original content
• non-GNU envsubst: rejected with a clear message, output untouched

Mutation-checked: with the direct-redirect shape temporarily restored, the failed-render and empty-render tests fail on the truncated (empty) output file; with the fix they pass.

Full libraries/ suite: 366 pass locally; the 6 pre-existing failures (attrs bare--/-- tests, two argsh::lint discovery tests) fail identically on a clean origin/main checkout in the same environment and are unrelated to this change.

🤖 Generated with Claude Code

https://claude.ai/code/session_016DJzGS3pNBzZs1jaEQ74Co