fix(tooling): parse devnet.env without eval, and stop dropping lines silently

The env loader was correct but unreadable: `eval "export $key=\$val"` escapes
the value so it expands after eval has parsed, and an `export name=value`
assignment suppresses word splitting, so multi-word values did arrive whole.
Nobody should have to know that to trust the line, and a reviewer already
read it as the interpolated form that would break SERVERS="host-a host-b".
Bash indirect expansion plus one quoted export word says the same thing with
nothing left to reparse.

While in there, the header's promise that comments and malformed lines are
skipped was only half true. A `# note` after an unquoted value landed inside
the value, so SERVERS picked up a host called '#' for sweep.sh to ssh to;
quoted values now delimit themselves, keeping a '#' that belongs to the value
(http://x/y#frag). A bare word with no '=' became a variable assigned its own
name. A leading-digit name reached `export` and produced its error instead of
ours. Indented lines were dropped outright. Names that can't be assigned are
now reported on stderr, because a config line that goes unread is how you
deploy against the wrong deployment.

Author: MegaRedHand

.claude/skills/multi-server-devnet/scripts/devnet-env.sh

@@ -9,8 +9,14 @@
 # since it names your hosts and may point at a webhook file).
 #
 # A value already set in the environment WINS over the file, so a one-off
-# `PROM_DS_UID=other ./deploy-finality-alert.sh` still overrides. Only simple
-# `KEY=value` / `export KEY=value` lines are read; `#` comments and blanks skipped.
+# `PROM_DS_UID=other ./deploy-finality-alert.sh` still overrides.
+#
+# Only simple `KEY=value` / `export KEY=value` lines are read. Blank lines and `#`
+# comments are skipped, as is a `# comment` tail following an UNQUOTED value; a
+# quoted value keeps its contents verbatim, `#` included. Leading indentation is
+# fine. A line that looks like an assignment but whose name isn't usable is
+# reported on stderr rather than dropped in silence, because a config line that
+# goes unread is how you deploy against the wrong deployment.
 devnet_load_env() {
   local dir file line key val
   dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -28,16 +34,34 @@ devnet_load_env() {
   [ -n "$file" ] || return 0
 
   while IFS= read -r line || [ -n "$line" ]; do
+    line=${line#"${line%%[![:space:]]*}"}          # ltrim, so an indented line is read
     case "$line" in ''|'#'*) continue ;; esac
-    line=${line#export }
+    case "$line" in *=*) ;; *) continue ;; esac     # not an assignment at all
+    case "$line" in export[[:space:]]*)
+      line=${line#export}; line=${line#"${line%%[![:space:]]*}"} ;;
+    esac
     key=${line%%=*}
     val=${line#*=}
-    # skip anything that isn't a plain shell name (comment tails, malformed lines)
-    case "$key" in ''|*[!A-Za-z0-9_]*) continue ;; esac
-    val=${val%\"} val=${val#\"}
-    val=${val%\'} val=${val#\'}
-    # file provides defaults only: keep an already-set value
-    if eval "[ -z \"\${$key:-}\" ]"; then eval "export $key=\$val"; fi
+    # Must be a name the shell can assign: a leading digit or any punctuation makes
+    # `export` fail with its own confusing error, and skipping in silence would hide
+    # the operator's typo. Name it and move on.
+    case "$key" in ''|[0-9]*|*[!A-Za-z0-9_]*)
+      echo "$file: ignoring '$key=...', not a variable name" >&2; continue ;;
+    esac
+    # Quotes, when present, DELIMIT the value, so a '#' or a trailing space inside
+    # them survives. Unquoted, a `# comment` tail is dropped: it used to end up
+    # inside the value, and for SERVERS that means sweep.sh ssh-ing to a host '#'.
+    case $val in
+      \"*) val=${val#\"}; val=${val%%\"*} ;;
+      \'*) val=${val#\'}; val=${val%%\'*} ;;
+      *)   val=${val%%[[:space:]]#*}                # comment tail
+           val=${val%"${val##*[![:space:]]}"} ;;    # rtrim what it left behind
+    esac
+    # File provides defaults only: keep an already-set value. No eval anywhere --
+    # `${!key}` is bash indirect expansion, and `export` gets ONE quoted
+    # name=value word, so a multi-word value (SERVERS="host-a host-b") arrives
+    # whole and nothing in it is ever reparsed as shell.
+    [ -n "${!key:-}" ] || export "$key=$val"
   done < "$file"
   echo "loaded deployment env from $file" >&2
 }