- Add set -euo pipefail to 33 install_*.sh scripts with version parameter pattern
- Fix parameter handling: REL=$1 → REL=${1:-} in all 33 scripts to handle unset parameters safely
- Fix additional unbound variable bugs in source.sh:
  - Initialized local variables with empty defaults: local owner='' instead of local owner
  - Fixed download_url variable in get_gh_release_latest() - was referenced before initialization
  - Changed unset download_url → download_url='' initialization pattern
- Move set -e statements to appear after comment blocks with blank line for readability
- All scripts tested and validated with shellcheck

Phase 2 of 4: Standard install scripts with version parameters

Affected: 33 install_*.sh scripts + source.sh improvements

Scripts: argorolloutscli, azcopy, bat, brew, cilium, crictl, etcdctl, exa, eza,
fastfetch, flux, fonts_cascadiacode, helm, k3d, k9s, kind, kubecolor, kubectl,
kubectx, kubelogin, kubeseal, kustomize, minikube, nerdctl, omp, pwsh, ripgrep,
terraform, terrascan, tflint, tfswitch, uv, yq

- Add set -euo pipefail to remaining install_*.sh scripts (btop, cmatrix, cowsay, fonts_nerd, fzf, gh, gnome, kde, kubectl-convert, nodejs, pixi, podman, prek, smee, zsh)
- Add set -eu to remaining POSIX sh scripts (autoexec, fix_secure_path, upgrade_system)
- Add set -euo pipefail to certificate fix scripts (fix_azcli_certs, fix_certifi_certs, fix_nodejs_certs)
- Fix parameter handling in install_azurecli, install_miniconda, install_miniforge (declare $param="${2:-}")
- Add set -euo pipefail to all setup_*.sh scripts (docker_mount, gh_https, gh_repos, gh_ssh, gnome, omp, profile_user, python, ssh)
- Add set -euo pipefail to set_*.sh scripts (authorized_keys, ulimits)
- Add set -euo pipefail to distro_check.sh utility script
- Fix unbound variable issues with ${1:-} and ${2:-} patterns throughout
- Initialize local variables in setup_gh_https.sh (gh_cfg='', key='')
- Move set -e statements to appear after comment blocks with blank line for readability
- All scripts tested and validated with shellcheck

Phase 3 of 4: Complex scripts with parameter parsing and setup scripts

Affected: 36 files (install, setup, set, fix, utility scripts)

- Change mktemp -dp to mktemp -d -p for cross-distro compatibility
- Add trap to remove TMP_DIR/tmp_dir on EXIT immediately after mktemp
- Remove obsolete 'rm -fr $TMP_DIR' commands and comments
- Remove unnecessary empty lines after removed commands
- Trap lines properly indented to match mktemp lines
- All scripts tested and validated with shellcheck

Affected: 36 files (install scripts using mktemp)
Scripts: argorolloutscli, azcopy, bat, brew, cilium, crictl, etcdctl, exa, eza,
fastfetch, fonts_cascadiacode, fonts_nerd, gcloud, gh, k9s, kind, kubecolor,
kubectl-convert, kubectl, kubectx, kubelogin, kubeseal, kustomize, miniconda,
miniforge, minikube, nerdctl, nodejs, omp, prek, pwsh, ripgrep, terrascan,
tflint, uv, yq

Total: 80 insertions(+), 121 deletions(-)

- Separate declaration and assignment for saved_return/saved_exit (SC2155)
- Add shellcheck disable directives for intentional trap expansion pattern
- Use consistent rm -fr flag order across codebase
- Declare all local variables upfront in install_github_release_user
- Remove unnecessary output redirection and duplicate local declarations