fix(compose): prevent silent flag consumption and shift crashes in stack resolver

[vaibhavsrv]

Why this matters

In ods/scripts/resolve-compose-stack.sh, flags expecting parameter values (--script-dir, --tier, --gpu-backend, --profile-overlays, --gpu-count, --ods-mode, and --skip-gpu-overlays) unconditionally perform shift 2 inside the argument parser without validating parameter existence. Under set -euo pipefail, omitting an argument causes the shell to fail abruptly on shift 2 with an unhandled exit code 1 and no error output. Even worse, when a parameter-less flag is immediately followed by a boolean switch (for instance, resolve-compose-stack.sh --tier --env), ${2:-$TIER} assigns the flag name "--env" to TIER, and the subsequent shift 2 silently consumes --env, completely bypassing environment-variable emission mode and producing standard compose flags.

This change inserts a surgical guard in the option loop verifying that parameter-requiring options have an actual value that does not start with a hyphen. If an argument is missing, empty, or another switch is passed, the script prints an informative diagnostic to stderr (Option <flag> requires an argument) and exits cleanly with code 1. Existing resolution flows, valid flag combinations, and fallback defaults are completely preserved.

Validation

• Baseline reproduction: Executing ods/scripts/resolve-compose-stack.sh --tier aborted with unhandled status 1 on shift 2 with no output. Executing ods/scripts/resolve-compose-stack.sh --tier --env swallowed --env, assigned --env to TIER, and exited 0 emitting compose arguments instead of environment variables.
• Post-fix validation: Missing, empty, or hijacked parameters now exit 1 with Option <flag> requires an argument on stderr.
• Telemetry: Compose resolution suites: 4 passed in new regression suite, 39 passed in test-resolve-compose-resilient.sh. New-test Ruff, ShellCheck, and diff checks pass; new regressions wired into Linux CI.

Overlap check

• fix: prevent loginctl interactive prompts from hanging installer #6792 deals with systemd loginctl sessions in installer bootstrapping and doesn't touch Docker Compose stack generation.
• fix: safely sanitize and parse .env values for opencode routing #6791 handles string sanitization in helper functions and has no overlap with resolve-compose-stack.sh.
• fix: harden python dependency installation against system-managed enviorments. #6790 hardens python package version requirements; it does not touch the shell-based Compose stack resolver.

Risk / AI disclosure

AI-assisted investigation, implementation and CLI regressions. This strengthens a CLI check, not runtime admission. Independent human review and platform/runtime qualification remain gates. No running configuration, deployment or upstream merge changed.

Follow-up integration evidence

Composed with #6796 at e7f7869f948bfbc5ff0337e7d6beab964ebcff92 without conflicts. Production and test diffs passed together; preflight and compose resolver checks remain intact.
Backlog composition was local-only (production/test diffs, excluding workflow/Makefile wiring); it is not an upstream merge or independent human approval. Declared live-review gates remain open.

[Lightheartdevs]

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.