Add set -euo pipefail to shell scripts

[cluster2600]

Summary

Addresses #142 — enables strict error handling across all shell scripts in the repository.

• Scripts that already had partial coverage (set -e, set -eo pipefail, set -Eo pipefail) are upgraded to include the -u flag for unbound variable detection
• Scripts with only set -x (debug tracing) now also get set -euo pipefail added before the existing set -x line
• Scripts with no error handling at all now have set -euo pipefail inserted after the shebang line
• Three scripts that were missing shebangs (_nvcf_creation.sh, _nvcf_deploy.sh, create-secrets.sh) also recieve a #!/bin/bash header
• aws/sagemaker/launch.sh uses #!/bin/sh, so it gets set -eu instead since pipefail is not POSIX-portable
• The only .sh file left untouched is the Helm library_chart/files/script.sh which is an empty template containing only licence headers and a comment — it has no actual commands

Breakdown by change type

Change	Files
set -e upgraded to set -euo pipefail	5
set -eo pipefail upgraded to set -euo pipefail	5
set -Eo pipefail upgraded to set -Euo pipefail	2
set -euo pipefail added (was set -x only)	6
set -euo pipefail added (no prior set flags)	10
set -eu added (#!/bin/sh script)	1
Shebang + set -euo pipefail added (no shebang existed)	3
Total	31 (+ 1 skipped template)

This should not change any existing behaviour for scripts that were already succeeding — the new flags only cause earlier, louder failures when something goes wrong, which is the recognised best practice for shell scripting.

Test plan

• Verify that no script has unintentionally broken syntax (e.g. run bash -n against each .sh file)
• Spot-check a few scripts to confirm set -euo pipefail is placed correctly relative to shebangs and licence headers
• Confirm aws/sagemaker/launch.sh uses set -eu (not pipefail) since it targets /bin/sh

[cluster2600]

Closing — no response after 3 weeks.