fix(packs): SP8 re-check, close before unlink cannot skip it; check the whole reason before the cut (#1873)

packages/bus/src/broker.mjs

@@ -7048,8 +7048,9 @@ export class Broker {
   #templateFail(e) {
     if (e?.name === 'TemplateError' && TEMPLATE_CODES.includes(e.code)) {
       // A reason names a field path or a definition name; one that would quote a held value is dropped.
-      let reason = typeof e.reason === 'string' ? e.reason.slice(0, 300) : undefined;
-      if (reason !== undefined) try { this.#secretCheck(reason); } catch { reason = undefined; }
+      // The check reads the whole reason before the cut, so a held value cut short is still found.
+      let reason = typeof e.reason === 'string' ? e.reason : undefined;
+      if (reason !== undefined) try { this.#secretCheck(reason); reason = reason.slice(0, 300); } catch { reason = undefined; }
       throw new BusError(e.code, reason);
     }
     this.#packFail(e);

packages/organization/src/template-save.mjs

@@ -440,8 +440,9 @@ export function templateSave({ document, name, project, digest, rolesDir, assert
     fsyncSync(fd);
   } catch (error) {
     // A partial file would hold the name: remove the file this call created, then report the failure.
-    closeSync(fd);
+    const open = fd;
     fd = undefined;
+    try { closeSync(open); } catch { /* the write failure is the one reported */ }
     try { unlinkSync(file); } catch { /* already gone */ }
     throw error;
   } finally {