c4ch3c4d3
778341b7a5
- merge_policies: interpreter failure now aborts with the temp file removed instead of moving an empty tmp into place (errexit is suppressed when the function is called in a || context, so the status is checked explicitly); config stays untouched on failure - move info/ok/warn/die above arg parsing so --allow-provider without a value prints the intended error, not 'die: command not found' - install_enterprise_policy: compare content before writing on the sudo path (skip when already enforced, warn on drift), repair the no-root-with-existing-file case instead of pinning env vars, chmod 644 the policy file in both paths - tests: in-place merge, fail-closed on bad JSON, clean arg error