DOCFIX-173: full-project sweep -- script logic bugs + security hardening ...

Four confirmed logic bugs (unguarded pipelines/function calls under
set -e+pipefail), all independently reproduced in isolation before being
trusted -- including catching that a first proposed fix for one of them
was itself wrong: `|| true` after a failing pipeline under pipefail
silently discards PIPESTATUS, which would have made phase-06-capi-stack's
own gate check never fire again. The correct `if pipeline; then :; fi`
idiom was verified via reproduction before committing.

- carve-host-interfaces.sh: emit()'s unguarded `return 1` killed apply-mode
  runs on the first MAAS error, before the FATAL-accumulator summary
  could print.
- phase-06-capi-stack.sh: run_step's PIPESTATUS read was dead code.
- juju-spaces-check.sh, osd-blank-check.sh: one unguarded display-only
  pipe each, safely `|| true`-able.
- ledger-scan.sh: DOCFIX/BUNDLEFIX next-free regex used a fixed {3} not
  {3,} -- the same bug class already fixed once for the D-series, never
  mirrored here. Dormant, not yet reachable, but a real landmine.
- dc-dc-rbd-mirror.sh: hardened the bootstrap token's default path
  (random suffix + immediate chmod 600, was a predictable /tmp filename
  with no permission hardening).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

addendum 33: script-quality fix batch DOCFIX-112..117 -- anti-escalation guard fail-closed (SECURITY), tenant-offboard hardening cluster, validate/juju-spaces fail-opens, pipefail sweep, guard-hook extension; deferred-findings register; ledger REMAINING-OPEN-WORK block ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

Adding scripts