fix: pre-landing review fixes for external-file sync (EGB-531)

Adversarial review of the diff surfaced 6 non-critical findings, all fixed:
- pull now warns + reports when a merge fails (read-only $HOME, full disk)
  instead of silently exiting 0 as if it synced
- push skips a multi-line (continuation) managed value with a warning rather
  than writing a dangling backslash that would corrupt the target
- absent-key pull check escapes regex '.' so systemProp.foo can't false-match
- fix garbled 'Merged 0\n0 key(s)' count when a blob has no '=' lines
- slug gets a cksum suffix so paths that clean to the same string (a/b vs a_b)
  don't overwrite each other's blob
- docs: backup happens before each merge, not just the first

Tests: 112 -> 113 (continuation-value skip).

secrets

@@ -464,9 +464,14 @@ _props_get() {
 }
 
 # Turn a manifest path token into a machine-independent blob slug.
+# A bare char-replace would collide (e.g. a/b and a_b both → a_b), so append a
+# checksum of the original path to keep distinct targets' blobs distinct.
 _secrets_files_slug() {
   local p="$1"
-  printf '%s' "${p//[!A-Za-z0-9._-]/_}"
+  local clean="${p//[!A-Za-z0-9._-]/_}"
+  local sum
+  sum=$(printf '%s' "$p" | cksum | cut -d' ' -f1)
+  printf '%s-%s' "$clean" "$sum"
 }
 
 # Merge managed key=value lines (from $2) into target file $1, preserving
@@ -569,8 +574,16 @@ push_external_files() {
     local found=0 k v
     for k in $mkeys; do
       if v=$(_props_get "$expanded" "$k"); then
-        printf '%s=%s\n' "$k" "$v" >> "$tmp"
-        found=$((found + 1))
+        if _trailing_bs_odd "$v"; then
+          # A trailing odd backslash means a multi-line (continuation) value.
+          # We only support single-line values; syncing this would write a
+          # dangling backslash that turns the next target line into a
+          # continuation and corrupts the file. Skip it loudly.
+          echo "WARNING: key '$k' in $mpath has a multi-line (continuation) value — not supported, skipping." >&2
+        else
+          printf '%s=%s\n' "$k" "$v" >> "$tmp"
+          found=$((found + 1))
+        fi
       else
         echo "WARNING: key '$k' not found in $mpath — not synced. Set it locally first, or remove it from $SECRETS_FILES_NAME." >&2
       fi
@@ -622,17 +635,21 @@ pull_external_files() {
       rm -f "$tmp"
       die "Decryption failed for external target $mpath."
     fi
-    local k
+    local k k_esc
     for k in $mkeys; do
-      grep -q "^$k=" "$tmp" 2>/dev/null || echo "WARNING: '$k' listed in $SECRETS_FILES_NAME but absent from synced data for $mpath." >&2
+      # Escape regex-special '.' so e.g. systemProp.foo can't match systemPropXfoo.
+      k_esc=$(printf '%s' "$k" | sed 's/\./\\./g')
+      grep -q "^$k_esc=" "$tmp" 2>/dev/null || echo "WARNING: '$k' listed in $SECRETS_FILES_NAME but absent from synced data for $mpath." >&2
     done
     if [ ! -d "$(dirname "$expanded")" ]; then
       echo "WARNING: creating $(dirname "$expanded")" >&2
     fi
-    local count; count=$(grep -c '=' "$tmp" 2>/dev/null || echo 0)
+    local count; count=$(grep -c '=' "$tmp" 2>/dev/null || true); count=${count:-0}
     if merge_gradle_keys "$expanded" "$tmp"; then
       local klist; klist=$(printf '%s' "$mkeys" | tr ' ' ',' | sed 's/,/, /g')
       info "Merged $count key(s) into $expanded ($klist)"
+    else
+      echo "WARNING: failed to merge keys into $expanded — target left unchanged." >&2
     fi
     rm -f "$tmp"
   done < <(_parse_secrets_files_manifest "$manifest")