Arming a dead guard changes what its error message must say

A ${VAR:?message} guard fires on unset OR empty, so a non-empty placeholder in the shipped example env file silently disables it. Emptying the placeholder arms the guard — but its remediation text still said "copy the example file to .env", which is exactly the action that produces the error, so the operator loops forever. The self-review missed this because the new error output was pasted as evidence the fix worked without anyone reading what it actually instructed. Two more traps in the same fix: umask governs file CREATION only, so a stale temp file left by an earlier crashed run gets truncated with its old 0644 mode intact and defeats the umask entirely (rm -f before the redirect is the real fix); and a colon-space anywhere inside a ${VAR:?...} message terminates the unquoted YAML scalar, so Compose fails with "mapping values are not allowed in this context" naming the line and never the cause. General rule: run every new regression test against the UNFIXED branch — one that passes there proves nothing, and that is how a test named for a temp file that actually probed a different file survived.