Make deploy-managed-agent.sh fail when an env-var value is refused

[akhilesharora]

set -euo pipefail does not catch a failed assignment when it runs inside a command substitution, and the deploy nests three deep: json=$(yaml2json ...) (in resolve_manifest) runs inside json=$(resolve_manifest ...) (in create_agent) runs inside OUT=$(create_agent ...). So when yaml2json rejects an env-var value (the SAFE allowlist excludes ?, &, =, so a connector URL carrying a ?token= query string is refused), the non-zero exit never propagates: resolve_manifest continues with an empty json, and the deploy reports success with no bodies.

In --dry-run that is EXIT 0 and an empty []. test-cookbooks.sh then iterates the empty list, finds no errors, and green-lights a cookbook that produced zero agents. The real path eventually errors, but with a misleading POST /v1/agents failed for : rather than the refusal reason.

Before (on main), a connector URL with a query string:

$ BOX_MCP_URL='https://mcp.box.com/sse?token=t' GDRIVE_MCP_URL=... REPO_SLUG=claude-for-legal \
    bash scripts/deploy-managed-agent.sh diligence-grid --dry-run
refusing ${BOX_MCP_URL}: value contains characters outside [A-Za-z0-9._/:@-]
# --dry-run: resolved POST /v1/agents bodies (subagents first, orchestrator last)
[]
EXIT=0          # success, zero bodies

After, the refusal aborts with its reason:

$ ... bash scripts/deploy-managed-agent.sh diligence-grid --dry-run
refusing ${BOX_MCP_URL}: value contains characters outside [A-Za-z0-9._/:@-]
EXIT=1

|| exit 1 on the four masked command substitutions (yaml2json, resolve_manifest, and both create_agent calls) makes the failure propagate through the nesting. A valid deploy is unchanged; test-cookbooks.sh still passes 5/5:

✓ diligence-grid   5 bodies
✓ docket-watcher   4 bodies
✓ launch-radar     4 bodies
✓ reg-monitor      4 bodies
✓ renewal-watcher  4 bodies

Tested on Ubuntu 24.04, bash 5.x. This fixes the silent swallow itself, which masks any future rejection. Widening the SAFE allowlist to accept URL query characters is a separate call (it guards a curl -F / jq injection surface), so I left it out.

Closes #77.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}