fix(shell): remove runtime early-exit pipe hazards

tools/e2e-install-test.sh

@@ -136,7 +136,8 @@ fi
 echo "=== [inner] Running mosaic gateway verify ==="
 # `gateway verify` was added in feat/mosaic-first-run-ux.
 # If the installed version pre-dates this, skip gracefully.
-if ! mosaic gateway --help 2>&1 | grep -q 'verify'; then
+gateway_help="$(mosaic gateway --help 2>&1 || true)"
+if ! grep -q 'verify' <<<"$gateway_help"; then
   echo "[SKIP] 'mosaic gateway verify' not available in installed version ${INSTALLED_VERSION}."
   echo "[SKIP] This command was added in the feat/mosaic-first-run-ux release."
   echo "[SKIP] Re-run after the new version is published to validate this step."

tools/install.sh

@@ -308,13 +308,17 @@ ensure_monorepo() {
     exit 1
   fi
 
-  # Gitea archives extract to <repo-name>/ inside the work dir
-  EXTRACTED_DIR="$(find "$WORK_DIR" -maxdepth 1 -mindepth 1 -type d | head -1)"
-  if [[ -z "$EXTRACTED_DIR" ]] || [[ ! -d "$EXTRACTED_DIR" ]]; then
-    fail "Could not locate extracted source in archive."
+  # Gitea archives extract to exactly one <repo-name>/ inside the work dir.
+  # Read the complete population so a malformed multi-root archive reaches the
+  # named diagnostic instead of aborting on an upstream SIGPIPE under pipefail.
+  local -a extracted_dirs=()
+  mapfile -d '' -t extracted_dirs < <(find "$WORK_DIR" -maxdepth 1 -mindepth 1 -type d -print0)
+  if [[ "${#extracted_dirs[@]}" -ne 1 ]] || [[ ! -d "${extracted_dirs[0]:-}" ]]; then
+    fail "Could not locate exactly one extracted source directory in archive."
     ls -la "$WORK_DIR" >&2
     exit 1
   fi
+  EXTRACTED_DIR="${extracted_dirs[0]}"
 }
 
 # Build @mosaicstack/mosaic + @mosaicstack/gateway from source and install both

tools/matrix-presence-harness/run.sh

@@ -35,7 +35,10 @@ export DARK_THRESHOLD_MS="${DARK_THRESHOLD_MS:-6000}"
 export AGENT_SLUGS="${AGENT_SLUGS:-alpha,bravo,charlie}"
 export VICTIM_SLUG="${VICTIM_SLUG:-charlie}"
 
-TSX_CLI="$(ls -d "${REPO}"/node_modules/.pnpm/tsx@*/node_modules/tsx/dist/cli.mjs 2>/dev/null | head -1)"
+shopt -s nullglob
+TSX_CANDIDATES=("${REPO}"/node_modules/.pnpm/tsx@*/node_modules/tsx/dist/cli.mjs)
+shopt -u nullglob
+TSX_CLI="${TSX_CANDIDATES[0]:-}"
 if [[ -z "${TSX_CLI}" ]]; then
   echo "run.sh: tsx not found under node_modules — run pnpm install first" >&2
   exit 1