fix: pre-landing review fixes for external-file sync (EGB-531)

Adversarial review of the diff surfaced 6 non-critical findings, all fixed:
- pull now warns + reports when a merge fails (read-only $HOME, full disk)
  instead of silently exiting 0 as if it synced
- push skips a multi-line (continuation) managed value with a warning rather
  than writing a dangling backslash that would corrupt the target
- absent-key pull check escapes regex '.' so systemProp.foo can't false-match
- fix garbled 'Merged 0\n0 key(s)' count when a blob has no '=' lines
- slug gets a cksum suffix so paths that clean to the same string (a/b vs a_b)
  don't overwrite each other's blob
- docs: backup happens before each merge, not just the first

Tests: 112 -> 113 (continuation-value skip).

test/secrets.bats

@@ -1451,6 +1451,18 @@ gradle_project() {
   [[ "$output" == *"symlink"* ]]
 }
 
+@test "EGB-531: push skips a multi-line (continuation) managed value with a warning" {
+  init_with_remote
+  mkdir -p "$HOME/.gradle"
+  # beaconClerkPkTest has a continuation value (trailing backslash); Live is single-line
+  printf '%s' $'beaconClerkPkTest=part1\\\npart2\nbeaconClerkPkLive=fine\n' > "$HOME/.gradle/gradle.properties"
+  gradle_project gproj
+  run "$SECRETS_BIN" push gproj
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"multi-line"* ]]
+  [[ "$output" == *"Extracted 1 key"* ]]
+}
+
 @test "EGB-531: push skips comment and continuation lines in source" {
   init_with_remote
   mkdir -p "$HOME/.gradle"