ci: harden feed/packaging shell scripts

- ci/make-index.sh: set -e → set -euo pipefail so a failing sha256sum|cut in
  the signed Packages index can't mask an empty SHA256. Script survives -u
  (all vars use :? or :- defaults).
- .github/deb2ipk.sh: quote $2/$DEB_NAME/output, derive the deb name from the
  copied file via basename instead of parsing `ls *.deb` (glob-fragile), add a
  trap-based tmpdir cleanup, and set -euo pipefail.

bash -n clean on both.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/deb2ipk.sh

@@ -1,28 +1,34 @@
 #!/usr/bin/env bash
 # mod from https://gist.github.com/pldubouilh/c5703052986bfdd404005951dee54683
 
-set -e -o pipefail
+set -euo pipefail
+
+ARCH=$1
+DEB_SRC=$2
+OUT_IPK=$3
 
 PROJECT=$(dirname "$0")/../..
-TMP_PATH=`mktemp -d`
-cp $2 $TMP_PATH
-pushd $TMP_PATH
+TMP_PATH=$(mktemp -d)
+trap 'rm -rf "$TMP_PATH"' EXIT
 
-DEB_NAME=`ls *.deb`
-ar x $DEB_NAME
+cp "$DEB_SRC" "$TMP_PATH"/
+pushd "$TMP_PATH" >/dev/null
+
+# Derive the name from the file we copied — do not glob-parse `ls *.deb`.
+DEB_NAME=$(basename "$DEB_SRC")
+ar x "$DEB_NAME"
 
 mkdir control
-pushd control
+pushd control >/dev/null
 tar xf ../control.tar.gz
-rm md5sums
-sed "s/Architecture:\\ \w*/Architecture:\\ $1/g" ./control -i
+rm -f md5sums
+sed "s/Architecture:\\ \w*/Architecture:\\ $ARCH/g" ./control -i
 cat control
 tar czf ../control.tar.gz ./*
-popd
+popd >/dev/null
 
 DEB_NAME=${DEB_NAME%.deb}
-tar czf $DEB_NAME.ipk control.tar.gz data.tar.gz debian-binary
-popd
+tar czf "$DEB_NAME.ipk" control.tar.gz data.tar.gz debian-binary
+popd >/dev/null
 
-cp $TMP_PATH/$DEB_NAME.ipk $3
-rm -r $TMP_PATH
+cp "$TMP_PATH/$DEB_NAME.ipk" "$OUT_IPK"

ci/make-index.sh

@@ -13,7 +13,7 @@
 # Feed format: opkg `src/gz` (.ipk + text Packages index, usign signature).
 # OpenWrt 24.10 (our SDK) still uses opkg; apk arrives at 25.12. The committed
 # trust anchor dist/shater-feed.pub is a usign (Ed25519) key, matching this.
-set -e
+set -euo pipefail
 OUT="${1:?feed dir required}"; cd "$OUT"
 : > Packages
 for ipk in *.ipk; do