refactor(dream-cli): guard .env grep pipelines against pipefail kill on missing keys

[yasinBursali]

What

Seven grep "^KEY=" .env | cut | tr pipelines in dream-cli would
exit 1 when the key is absent. Under set -eo pipefail those
pipelines would kill the script before the downstream defensive
checks ([[ -n ... ]], ${var:-(not set)}) can handle the
empty-on-miss case the surrounding code was written for.

Why

The surrounding code treats missing keys as benign (empty string,
"not set" default, fallthrough to defaults). That contract held
pre-pipefail because a grep miss yielded an empty pipeline output
with exit 0. Post-pipefail, a grep miss propagates exit 1, and
because these pipelines are assigned with bare VAR=$(...) (not
local VAR=$(...), which would mask the exit status), set -e
kills the script mid-flow.

How

Appended || true to each of the seven pipelines:

line	function	key read
254	_check_version_compat	DREAM_VERSION
836	cmd_dry_run	DREAM_VERSION
849	cmd_dry_run	DASHBOARD_API_KEY
938	cmd_dry_run loop	model-related keys
953	cmd_dry_run loop (2)	model-related keys
1434	cmd_enable	GPU_BACKEND
1781	cmd_preset	DREAM_MODE

Line 254 additionally swaps | head -1 for | sed -n '1p' —
SIGPIPE-safe under pipefail, portable across BSD and GNU sed.

Line 1434 additionally picks up a missing 2>/dev/null for
consistency with the other six sites.

Six other grep "^KEY=" pipelines in the file (around lines 2082,
2084–2086, 2163–2164) use the single-line local VAR=$(...) form,
which masks the pipeline exit status (a local command always
exits 0 regardless of RHS) — those sites are already safe and are
intentionally out of scope.

Testing

• bash -n passes.
• shellcheck diff against base: zero new warnings.
• Behavior confirmed under set -eo pipefail:
  • grep '^NOPE=' file | cut -d= -f2 | tr -d '[:space:]' || true → rc=0, empty value (missing key).
  • grep '^FOO=' file | cut -d= -f2 | tr -d '[:space:]' || true → rc=0, value returned (present key).
• sed -n '1p' works identically on BSD (macOS) and GNU (Linux)
  sed; no platform hazard.

Merge order (important)

This refactor is preventive on upstream/main today: dream-cli
is on set -e only, so a grep miss in any of these pipelines is
silently absorbed. It becomes load-bearing the moment #998
(fix/dream-cli-pipefail-exit-codes, enables set -o pipefail)
merges — without this fix in place, dream update, dream rollback, dream enable, dream preset, and dream dry-run can
abort mid-flow on installs that predate (or manually-edited-out) a
given .env key.

Recommended ordering: merge this PR in the same batch as
#998, or land this first. If #998 merges alone, users on upstream
hit the regression immediately.

Platform Impact

• macOS / Linux / Windows WSL2: POSIX grep, cut, tr, sed -n '1p' all behave identically. Zero platform risk.

---

📋 Chain status (operator's reminder — apr-25)

This PR is the head of a dream-cli strict-mode chain:

#1008 (this) ──READY──▶ #998 ──DRAFT─▶ #1002 ──DRAFT
                              └──────▶ #1018 ──DRAFT

After this PR merges, the next operator step is:

1. Promote fix(dream-cli): pipefail + surface LLM failures + exit-code contract #998 from DRAFT → ready (gh pr ready 998).
2. Maintainer merges fix(dream-cli): pipefail + surface LLM failures + exit-code contract #998.
3. Operator rebases refactor(dream-cli): enable set -u and add guards for conditional variables #1002 onto post-fix(dream-cli): pipefail + surface LLM failures + exit-code contract #998 main (shared hunks drop out automatically) → promote refactor(dream-cli): enable set -u and add guards for conditional variables #1002.
4. Operator does the same for test(dream-cli): BATS regression shield for 5 dream-cli / supporting behaviors #1018 (after its other 4 deps land — fix(dream-cli): schema-driven secret masking + macOS Bash 4 validation #994, fix(dashboard,dashboard-api): sentinel-based setup wizard success detection #1003, fix(dream-cli): Apple GPU output polish + compose wrapper SIGINT/zero-match #1016, plus fix(dream-cli): pipefail + surface LLM failures + exit-code contract #998 itself).

#998 / #1002 / #1018 are kept in DRAFT as a mechanical safeguard so they cannot merge before this one.