fix(cli): reject missing option values instead of crashing under set -u

[0xacee]

Summary

Every ODS entry-point script runs under set -euo pipefail, but 13 option parsers read "$2" without checking it exists. Passing a documented value-option as the last argument crashes with $2: unbound variable — no usage hint, and in install-core.sh's case the ERR trap prints a misleading "Installation failed during phase: init" banner for what is really a CLI typo.

Why this matters

All of these are documented in each script's --help output, so ./install.sh --tier (forgot the tier), ods backup --output (forgot the path), ods-test.sh -s (forgot the service) are reachable operator errors. The crash also bypasses each script's own error convention (error(), log_error+usage, exit-code contract), which matters for wrappers and CI that parse stderr.

Sites fixed (guard convention copied from ods-uninstall.sh, which already has it):

• install-core.sh — --tier, --lemonade-url, --lemonade-api-key, --external-llm-url, --external-llm-provider, --external-llm-model, --summary-json
• ods-backup.sh — -o|--output, -t|--type, -d|--delete, --description
• scripts/pre-download.sh — --tier
• scripts/ods-test.sh — -s|--service

Each arm now does [[ $# -ge 2 && -n "$2" ]] || <file's error path> before consuming $2, rejecting both a missing argument and an explicitly empty one.

Overlap check

• fix(load-backend): reject missing option value for backend in load-backend-contract.sh #5558 (open) — same defect class but only in scripts/load-backend-contract.sh; that file already has its guard upstream, and it is not touched here.
• fix(installer): reject --lemonade-api-key without an external Lemonade selection #6124 (open) — changes --lemonade-api-key semantics (reject without external Lemonade). Adjacent line in install-core.sh; trivial one-line conflict whichever lands second.
• fix(installer): accept documented --bootstrap flag #6027 (open) — adds a --bootstrap arm to the same case block; no line overlap.
• install-macos.sh (${2:-}) and ods-uninstall.sh (explicit $# check) already guard their parsers — verified while scoping; no changes needed there.
• Searched open PRs for "unbound variable", "argument", "parse", and each touched file — no other claims on these sites.

Regression test

ods/tests/test-option-arg-guards.sh runs all 17 flag spellings as trailing arguments and asserts: non-zero exit, no unbound variable text, and a requires-style error message.

Validation

• Fix branch: 17 passed, 0 failed.
• Clean upstream/public-beta (4d725ee95): 0 passed, 17 failed — every site crashes on unbound variable.
• bash -n and shellcheck -S error clean on all 5 files; git diff --check clean.

Pending: CI and maintainer review.