infra/pi: install.sh keeps the deployed KVITT_TAG and checks python3; env_set cleans its temp file; backup.sh removes half-written archives on failure

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/pi/lib.sh

@@ -21,13 +21,12 @@ env_set() {
   local key=$1 value=$2 file=${3:-$KVITT_DIR/.env} tmp
   tmp=$(mktemp "$file.XXXXXX")
   if grep -q "^$key=" "$file"; then
-    awk -v k="$key" -v v="$value" 'index($0, k "=") == 1 { print k "=" v; next } { print }' "$file" > "$tmp"
+    awk -v k="$key" -v v="$value" 'index($0, k "=") == 1 { print k "=" v; next } { print }' "$file" > "$tmp" \
+      || { rm -f "$tmp"; return 1; }
   else
-    cat "$file" > "$tmp"
-    printf '%s=%s\n' "$key" "$value" >> "$tmp"
+    { cat "$file" && printf '%s=%s\n' "$key" "$value"; } > "$tmp" || { rm -f "$tmp"; return 1; }
   fi
-  chmod --reference="$file" "$tmp"
-  mv -f "$tmp" "$file"
+  if ! { chmod --reference="$file" "$tmp" && mv -f "$tmp" "$file"; }; then rm -f "$tmp"; return 1; fi
 }
 
 compose() {