fix(scripts): Harden tier-manifest helper per code review (ref #80)

- Guard yaml.safe_load returning None on empty manifests
- Reject non-string entries in .packages[] with clear error
- Use RETURN trap for tmpdir cleanup (covers Ctrl-C, set -e trips)
- Document python3-yaml dependency + add friendly pre-check

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/lib/tier-manifest.sh

@@ -5,6 +5,10 @@
 #
 # Note: secubox gen emits manifest.yaml (YAML, not JSON).
 # Package list lives at the top-level .packages[] key.
+#
+# Dependencies:
+#   - python3 (>=3.9)
+#   - python3-yaml (Debian package). Install: sudo apt-get install -y python3-yaml
 
 _secubox_bin() {
   local bin
@@ -28,12 +32,18 @@ tier_manifest() {
     return 0
   fi
 
+  if ! python3 -c 'import yaml' 2>/dev/null; then
+    echo "ERROR: tier-manifest.sh requires python3-yaml. Install: sudo apt-get install -y python3-yaml" >&2
+    return 1
+  fi
+
   local sb; sb="$(_secubox_bin)" || return 1
   local tmpdir; tmpdir="$(mktemp -d)"
+  # Cleanup on any return path (success, error, interrupt under set -e)
+  trap 'rm -rf "$tmpdir"' RETURN
 
   if ! "$sb" gen --tier "$tier" --board mochabin --out "$tmpdir" >/dev/null 2>&1; then
     echo "ERROR: secubox gen --tier $tier failed" >&2
-    rm -rf "$tmpdir"
     return 1
   fi
 
@@ -44,7 +54,6 @@ tier_manifest() {
   if [[ ! -f "$mf" ]]; then
     echo "ERROR: secubox gen produced no manifest.yaml in $tmpdir" >&2
     find "$tmpdir" -type f >&2
-    rm -rf "$tmpdir"
     return 1
   fi
 
@@ -56,7 +65,7 @@ manifest_path = sys.argv[1]
 out_path = sys.argv[2]
 
 with open(manifest_path, "r") as f:
-    doc = yaml.safe_load(f)
+    doc = yaml.safe_load(f) or {}
 
 packages = doc.get("packages", [])
 if not isinstance(packages, list):
@@ -67,6 +76,9 @@ if not isinstance(packages, list):
 seen = set()
 unique = []
 for p in packages:
+    if not isinstance(p, str):
+        print(f"ERROR: non-string entry in .packages[]: {p!r}", file=sys.stderr)
+        sys.exit(1)
     if p not in seen:
         seen.add(p)
         unique.append(p)
@@ -75,6 +87,4 @@ with open(out_path, "w") as f:
     json.dump(unique, f)
     f.write("\n")
 PYEOF
-
-  rm -rf "$tmpdir"
 }