fix(env): load derived dotenv vars under nounset

scripts/lib/common/env.sh

@@ -20,14 +20,26 @@ load_env() {
     esac
   done
   if [ -f "$file" ]; then
+    local had_nounset=0
+    if [[ $- == *u* ]]; then
+      had_nounset=1
+      set +u
+    fi
     # shellcheck disable=SC2046
     set -a; . "$file"; set +a
+    (( had_nounset )) && set -u
   fi
   if [ -n "$profile" ]; then
     local pf="${file}.${profile}"
     if [ -f "$pf" ]; then
+      local had_nounset_profile=0
+      if [[ $- == *u* ]]; then
+        had_nounset_profile=1
+        set +u
+      fi
       # shellcheck disable=SC2046
       set -a; . "$pf"; set +a
+      (( had_nounset_profile )) && set -u
     fi
   fi
 }

scripts/lib/config/env.sh

@@ -15,11 +15,17 @@ load_env() {
     if [ -f "$env_file" ]; then
         # Export variables, ignoring comments and empty lines.
         # Disable set -e so a failing command in .env (e.g. command substitution) does not exit the shell.
+        local had_nounset=0
+        if [[ $- == *u* ]]; then
+            had_nounset=1
+            set +u
+        fi
         set -a
         set +e
         source <(grep -v '^#' "$env_file" | grep -v '^$' | sed 's/^/export /') 2>/dev/null || true
         set -e
         set +a
+        (( had_nounset )) && set -u
     fi
 }
 
@@ -36,4 +42,3 @@ set_subscription() {
 
 # Auto-load env if PROJECT_ROOT is set
 [ -n "${PROJECT_ROOT:-}" ] && load_env
-