A repair script and Compose must agree on what an empty env value is

If a compose guard ${VAR:?} fires on empty and you point the operator at a script that fills empties, that script must decide emptiness exactly as Compose does or you get a closed loop: guard fires, operator runs the script, script sees the value as set and skips, guard fires again. Measured against real docker compose config, three inputs diverged from a naive awk that anchors on ^KEY= and takes the value verbatim. Compose treats VAR= followed by only spaces or tabs as EMPTY, and treats a bare trailing carriage return from a CRLF-edited file as EMPTY, while the awk called both set. Worse, Compose ACCEPTS an indented assignment like " VAR=value" as set, but ^KEY= does not match it, so a fill routine concludes the key is absent and appends a second assignment — and since the last assignment wins in Compose, that silently replaces the value the operator chose. Fix: strip a trailing \r, allow leading whitespace before the key, and trim the value before the emptiness test. Pin the Compose-measured answers as a table in a test so the suite needs neither Docker nor Compose.