Harden fix-genre, sync-bandcamp, upgrade-mp3-to-flac under strict mode (R1)

- fix-genre.sh: set -euo pipefail; guard the tag-remove metaflac calls and the
  'beet ls | head -5' verify (SIGPIPE) that would otherwise abort.
- sync-bandcamp.sh: set -euo pipefail; the destructive chain already used
  'if cmd; then..else WARN' (set -e exempt); guard the staging mv.
- upgrade-mp3-to-flac.sh: set -euo pipefail; capture sldl/replace-with-better
  exit codes without aborting (was 'cmd; RC=$?', which set -e breaks); read
  Soulseek creds from the first available .conf instead of a hardcoded y2k.conf,
  guarded; guard the xargs purge and a grep -c.
- pipeline-status.sh: deliberately kept at set -u (documented). It is read-only
  and assembles ~30 independent probes; set -e would abort the whole digest on
  one missing optional file, which is exactly how the 9am notification broke.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pipeline/lib/pipeline-status.sh

@@ -18,6 +18,14 @@
 # Only flags SCRIPT-level failures, not per-file Soulseek errors (those are
 # normal — peers go offline, connections reset).
 
+# set -u only, NOT -e/pipefail, on purpose. This script is read-only: it
+# assembles a status digest from ~30 independent probes (grep over logs, beet
+# queries, curl health checks, optional-credential file reads). Each probe is
+# allowed to fail individually and report a warn/skip line; that's the whole
+# design. Under set -e a single missing optional file (e.g. qobuz/app_id) or a
+# no-match grep would abort the entire run and send NO digest at all, which is
+# the opposite of what a health report should do. It writes no library state,
+# so there is nothing to leave half-applied.
 set -u
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin