fix(macos): make ods-macos.sh upsert_env_value literal-key and delimiter-safe

[vaibhavsrv]

Summary

The macOS environment helper upsert_env_value could silently overwrite sibling keys if given a regex wildcard like a dot (e.g. FOO.BAR overwrites FOO_BAR). A value containing sed delimiters like pipes or ampersands could also corrupt the substitution and drop the value entirely. The helper now probes with a literal-prefix match and safely writes values verbatim without regular expressions or sed delimiters, mimicking the hardened env-generator.sh implementation. Fixes #7484.

AI Assistance

Antigravity provided investigation, with autonomous corrections, independent tests, and live macOS simulation verification.

Release Lane

• Stable hotfix targeting release/2.6.x
• Mainline change targeting main
• Next-minor work targeting the next feature/minor release
• Not sure; reviewer should help classify

Stable hotfix reason:

Changed Surface

• Docs only
• Tests only
• Dashboard UI
• Dashboard API / host agent
• Installer / bootstrap / lifecycle
• Docker Compose / service manifests
• Model routing / Hermes / capabilities
• Network exposure / auth / proxy
• Dependencies / runtime wiring

Risk And Validation

• Risk level: Low
• Validation run:
  • git diff --check
  • Markdown/link sanity for docs
  • Focused tests listed below
  • Dashboard lint/test/build
  • Extension audit / compose validation
  • Release-grade fleet or scoped hardware validation
  • Stable-lane patch validation, if targeting release/2.6.x
  • Not required because:

Commands/results:

$ bash ods/tests/test_macos_upsert_env_value.py
env-generator.sh: passed.
ods-macos.sh: passed.

$ shellcheck --severity=error ods/installers/macos/ods-macos.sh
$ python3 -m ruff check ods/tests/test_macos_upsert_env_value.py

Operational Change Check

If this PR touches installer phases, bootstrap logic, compose stack generation,
service manifests, dashboard API control flows, Hermes, model routing, GPU or
runtime detection, lifecycle commands, host mutation, or network exposure, it
requires release-grade fleet validation before release unless the PR explains a
narrower equivalent.

• This is not an operational change.
• This is an operational change and validation is recorded above.
• This is an operational change and validation is intentionally deferred for:

Notes For Reviewers

This is scoped live environment validation. The broader Mac installer recovery and preview issues are tracked separately, and full fleet acceptance remains pending.

[vaibhavsrv]

Closing this as the edge cases (keys with dots, values with delimiters) are purely theoretical in the context of ODS's current macOS installer implementation, so the practical impact doesn't justify the churn. Thanks!