fix(defense): route errors to stderr, guard cd/link, portable read

[Gerrrt]

What

Low-severity error-handling and portability cleanups from the fleet static-analysis audit.

• defense/defense.zsh — send the docker not installed / no compose file / mkcase usage / gocase "no cases dir" messages to stderr (>&2) instead of stdout, and in gocase cd before exporting $CASE with || return 1. Brings Defense in line with Kali's offensive.zsh.
• bootstrap.sh — check the ln -s exit code in link() so a failed symlink is visible, and declare the wire_links loop var local f so it doesn't leak into the caller shell.
• detections/siem/gen-siem.sh — replace mapfile (bash 4+) with a while read loop so the SIEM generator runs on macOS's stock bash 3.2 (Defense is distro-agnostic).

Verification

• bash -n clean on bootstrap.sh and gen-siem.sh; .zsh validated by zsh -n in CI.

🤖 Generated with Claude Code

---

Generated by Claude Code

[Copilot]

Pull request overview

This PR makes small, targeted shell portability and error-handling improvements across the Defense dotfiles tooling, aligning runtime behavior with the stated “distro-agnostic” goal and making failures/usage errors surface correctly.

Changes:

• Route several user-facing error/usage messages in defense/defense.zsh to stderr and harden gocase by guarding cd before exporting CASE.
• Make bootstrap.sh’s link() report symlink failures explicitly and prevent wire_links’ loop variable from leaking into the caller scope.
• Update detections/siem/gen-siem.sh to avoid mapfile (bash 4+) in favor of a bash 3.2-compatible while read loop for macOS compatibility.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
detections/siem/gen-siem.sh	Replaces mapfile with a portable read loop to support macOS bash 3.2 while preserving deterministic ordering.
defense/defense.zsh	Sends key error/usage messages to stderr and ensures gocase only exports CASE after a successful cd.
bootstrap.sh	Surfaces ln -s failures via stderr + non-zero return and scopes wire_links loop var with local.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.