fix: v0.9.1 robustness cleanups

- run_resume falls back to a new conversation only when the transcript file
  is gone; other failures end at the menu with the recorded id intact.
- The SessionStart hook resolves the session name under the registry lock;
  rename holds it across tmux rename-session and the registry move
  (dd_registry_locked, nestable).
- dd_load_env parses KEY=value like systemd instead of sourcing the files.
- devdesk-deploy: DPkg::Lock::Timeout, explicit FAILED lines on stdout and in
  the log; the hook answers synchronously and CI checks the HTTP status.
  logrotate for the deploy log.
- postinst drops duplicate terminal-features entries; hooks sweep stale
  temp files.

Closes #12

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libexec/devdesk-lib.sh

@@ -8,13 +8,34 @@ DEVDESK_ENV=${DEVDESK_ENV:-/etc/devdesk/env}
 # Local overrides go in env.local: it is never shipped, so upgrades don't prompt about it.
 DEVDESK_ENV_LOCAL=${DEVDESK_ENV_LOCAL:-${DEVDESK_ENV}.local}
 
+# The env files are read by systemd (EnvironmentFile=) as well, so they are
+# parsed here the way systemd parses them, never sourced: KEY=value lines, the
+# value taken literally (no $ expansion, no command substitution), optionally
+# in matching quotes. Anything else is reported and skipped (devdesk#12).
 dd_load_env() {
-    local f
-    for f in "$DEVDESK_ENV" "$DEVDESK_ENV_LOCAL"; do
-        if [ -r "$f" ]; then
-            # shellcheck source=/dev/null
-            . "$f"
-        fi
+    local _dd_f _dd_line _dd_n _dd_key _dd_val
+    for _dd_f in "$DEVDESK_ENV" "$DEVDESK_ENV_LOCAL"; do
+        [ -r "$_dd_f" ] || continue
+        _dd_n=0
+        while IFS= read -r _dd_line || [ -n "$_dd_line" ]; do
+            _dd_n=$((_dd_n + 1))
+            _dd_line=${_dd_line%$'\r'}
+            [[ $_dd_line =~ ^[[:space:]]*([#\;].*)?$ ]] && continue
+            if ! [[ $_dd_line =~ ^[[:space:]]*([A-Z_][A-Z0-9_]*)=(.*)$ ]]; then
+                printf 'devdesk: %s:%s: not a KEY=value line, ignored\n' "$_dd_f" "$_dd_n" >&2
+                continue
+            fi
+            _dd_key=${BASH_REMATCH[1]}
+            _dd_val=${BASH_REMATCH[2]}
+            _dd_val=${_dd_val%"${_dd_val##*[![:space:]]}"} # trailing blanks, like systemd
+            if [[ $_dd_val =~ ^\"(.*)\"$ || $_dd_val =~ ^\'(.*)\'$ ]]; then
+                _dd_val=${BASH_REMATCH[1]}
+            elif [[ $_dd_val == [\"\']* ]]; then
+                printf 'devdesk: %s:%s: unmatched quote, ignored\n' "$_dd_f" "$_dd_n" >&2
+                continue
+            fi
+            printf -v "$_dd_key" '%s' "$_dd_val"
+        done <"$_dd_f"
     done
 }
 dd_load_env
@@ -101,26 +122,59 @@ dd_registry_get() {
     jq -Mr --arg n "$1" --arg f "$2" '.sessions[$n][$f] // empty' "$DEVDESK_REGISTRY" 2>/dev/null
 }
 
-# dd_registry_update JQ_FILTER [jq args...] — read-modify-write under flock.
-dd_registry_update() {
-    local filter=$1
-    shift
+# dd_registry_locked CMD [ARGS...] — run CMD holding the registry lock, so a
+# step that reads tmux and then writes the registry (the SessionStart hook,
+# rename) can't interleave with another. Nests: an update inside reuses it.
+dd_registry_locked() {
+    if [ -n "${DD_REGISTRY_LOCKED:-}" ]; then
+        "$@"
+        return
+    fi
     mkdir -p "$DEVDESK_STATE_DIR"
     (
         flock -w 5 9 || exit 1
-        [ -s "$DEVDESK_REGISTRY" ] || printf '{"sessions":{}}\n' >"$DEVDESK_REGISTRY"
-        local tmp
-        tmp=$(mktemp "$DEVDESK_REGISTRY.XXXXXX") || exit 1
-        if jq "$@" "$filter" "$DEVDESK_REGISTRY" >"$tmp"; then
-            chmod 600 "$tmp"
-            mv -f "$tmp" "$DEVDESK_REGISTRY"
-        else
-            rm -f "$tmp"
-            exit 1
-        fi
+        DD_REGISTRY_LOCKED=1
+        "$@"
     ) 9>"$DEVDESK_REGISTRY.lock"
 }
 
+# dd_registry_update JQ_FILTER [jq args...] — read-modify-write under flock.
+dd_registry_update() {
+    dd_registry_locked _dd_registry_apply "$@"
+}
+
+_dd_registry_apply() {
+    local filter=$1 tmp
+    shift
+    [ -s "$DEVDESK_REGISTRY" ] || printf '{"sessions":{}}\n' >"$DEVDESK_REGISTRY"
+    tmp=$(mktemp "$DEVDESK_REGISTRY.XXXXXX") || return 1
+    if jq "$@" "$filter" "$DEVDESK_REGISTRY" >"$tmp"; then
+        chmod 600 "$tmp"
+        mv -f "$tmp" "$DEVDESK_REGISTRY"
+    else
+        rm -f "$tmp"
+        return 1
+    fi
+}
+
+# Claude's conversation files: ~/.claude/projects/<folder>/<id>.jsonl.
+dd_projects_dir() {
+    printf '%s/projects\n' "${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
+}
+
+dd_convo_file() {
+    [[ $1 =~ ^[0-9a-f-]{36}$ ]] || return 1
+    compgen -G "$(dd_projects_dir)/*/$1.jsonl" | head -n1
+}
+
+# Temp files of writers that were killed mid-write (hooks run under Claude's
+# timeouts): .<session>.XXXXXX and registry.json.XXXXXX, older than 10 minutes.
+dd_sweep_tmp() {
+    find "$DEVDESK_CONTEXT_DIR" "$DEVDESK_STATUS_DIR" -maxdepth 1 -type f -name '.*.??????' -mmin +10 -delete 2>/dev/null
+    find "$DEVDESK_STATE_DIR" -maxdepth 1 -type f -name 'registry.json.??????' -mmin +10 -delete 2>/dev/null
+    return 0
+}
+
 dd_registry_set_dir() {
     dd_registry_update '.sessions[$n] = ((.sessions[$n] // {}) + {dir: $d, updated: $t})' \
         --arg n "$1" --arg d "$2" --arg t "$(date -Is)"