Harden fix-genre, sync-bandcamp, upgrade-mp3-to-flac under strict mode (R1)

- fix-genre.sh: set -euo pipefail; guard the tag-remove metaflac calls and the
  'beet ls | head -5' verify (SIGPIPE) that would otherwise abort.
- sync-bandcamp.sh: set -euo pipefail; the destructive chain already used
  'if cmd; then..else WARN' (set -e exempt); guard the staging mv.
- upgrade-mp3-to-flac.sh: set -euo pipefail; capture sldl/replace-with-better
  exit codes without aborting (was 'cmd; RC=$?', which set -e breaks); read
  Soulseek creds from the first available .conf instead of a hardcoded y2k.conf,
  guarded; guard the xargs purge and a grep -c.
- pipeline-status.sh: deliberately kept at set -u (documented). It is read-only
  and assembles ~30 independent probes; set -e would abort the whole digest on
  one missing optional file, which is exactly how the 9am notification broke.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pipeline/lib/sync-bandcamp.sh

@@ -6,7 +6,7 @@
 # Reads $ALEMBIC_CONFIG_DIR/pipeline/bandcamp/config.env for username, format pref, etc.
 # Run as root (cron). Logs to ${ALEMBIC_CONFIG_DIR:-/config}/logs/bandcamp-YYYYMMDD.log.
 
-set -u
+set -euo pipefail
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 export PATH
 
@@ -81,7 +81,7 @@ log "$NEW_COUNT new audio file(s) staged; moving to $IMPORT_ME for import"
 shopt -s dotglob nullglob
 for entry in "$BANDCAMP_STAGING"/*; do
   [[ -e "$entry" ]] || continue
-  mv "$entry" "$IMPORT_ME/" 2>>"$LOG"
+  mv "$entry" "$IMPORT_ME/" 2>>"$LOG" || log "WARN: failed to move $entry into $IMPORT_ME"
 done
 shopt -u dotglob nullglob