fix: address multiple bugs from code review

- teardown_all.sh: replace `yes |` pipeline with `< <(yes)` process
  substitution to avoid SIGPIPE (exit 141) false failures under pipefail
- phase6_teardown.sh: extract push mirror `.id` instead of `.remote_name`
  to match the DELETE /push_mirrors/{id} API contract
- phase5_migrate_pipelines.sh: expand sed regex from `[a-z_]*` to
  `[a-z_.]*` to handle nested GitHub contexts like
  `github.event.pull_request.number`
- lib/common.sh: render_template now requires explicit variable list to
  prevent envsubst from eating Nginx variables ($host, $proxy_add_...)
- backup scripts: remove MacBook relay, use direct Unraid↔Fedora SCP;
  fix dump path to write to /data/ (mounted volume) instead of /tmp/
  (container-only); add unzip -t integrity verification
- preflight.sh: add --skip-port-checks flag for resuming with
  --start-from (ports already bound by earlier phases)
- run_all.sh: update run_step to pass extra args; use --skip-port-checks
  when --start-from > 1
- post-checks (phase4/7/9): wrap API calls in helper functions with
  >/dev/null redirection instead of passing -o /dev/null as API data
- phase8: replace GitHub archiving with [MIRROR] description marking
  and disable wiki/projects/Pages (archived repos reject push mirrors)
- restore_to_primary.sh: add require_vars for Fedora SSH variables

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phase8_cutover.sh

@@ -58,7 +58,8 @@ render_nginx_http_only() {
   # Set dummy cert paths (not used in HTTP-only mode)
   export SSL_CERT_FULLPATH="/dev/null"
   export SSL_KEY_FULLPATH="/dev/null"
-  render_template "${SCRIPT_DIR}/templates/nginx-gitea.conf.tpl" "$rendered"
+  render_template "${SCRIPT_DIR}/templates/nginx-gitea.conf.tpl" "$rendered" \
+    '${GITEA_DOMAIN} ${UNRAID_IP} ${UNRAID_GITEA_PORT} ${SSL_CERT_FULLPATH} ${SSL_KEY_FULLPATH}'
 
   # Strip the HTTPS server block (everything between markers inclusive)
   sed '/# SSL_HTTPS_BLOCK_START/,/# SSL_HTTPS_BLOCK_END/d' "$rendered" > "$tmpfile"
@@ -75,7 +76,8 @@ render_nginx_https() {
   export GITEA_DOMAIN UNRAID_IP UNRAID_GITEA_PORT
   export SSL_CERT_FULLPATH="$cert_path"
   export SSL_KEY_FULLPATH="$key_path"
-  render_template "${SCRIPT_DIR}/templates/nginx-gitea.conf.tpl" "$rendered"
+  render_template "${SCRIPT_DIR}/templates/nginx-gitea.conf.tpl" "$rendered" \
+    '${GITEA_DOMAIN} ${UNRAID_IP} ${UNRAID_GITEA_PORT} ${SSL_CERT_FULLPATH} ${SSL_KEY_FULLPATH}'
 
   # Replace the redirect block content with a 301 redirect to HTTPS
   # The block between markers gets replaced with just the redirect
@@ -266,39 +268,47 @@ else
 fi
 
 # ---------------------------------------------------------------------------
-# Step 11: Archive GitHub repos
-# Marks repos as archived with a "[MOVED]" description pointing to Gitea.
-# Preserves the original description by appending it after "— was: ".
+# Step 11: Mark GitHub repos as offsite backup only
+# Updates description + homepage to indicate Gitea is primary.
+# Disables wiki and Pages to avoid unnecessary resource usage.
+# Does NOT archive — archived repos reject pushes, which would break
+# the push mirrors configured in Phase 6.
+# Preserves original description by appending after "— was: ".
+# GitHub Actions already disabled in Phase 6 Step D.
 # ---------------------------------------------------------------------------
-log_step 11 "Archiving GitHub repos..."
+log_step 11 "Marking GitHub repos as offsite backup..."
 
 for repo in "${REPOS[@]}"; do
-  # Check if already archived
-  IS_ARCHIVED=$(github_api GET "/repos/${GITHUB_USERNAME}/${repo}" 2>/dev/null | jq -r '.archived' || echo "false")
-  if [[ "$IS_ARCHIVED" == "true" ]]; then
-    log_info "GitHub repo ${repo} already archived — skipping"
+  # Fetch repo metadata (single API call)
+  REPO_DATA=$(github_api GET "/repos/${GITHUB_USERNAME}/${repo}" 2>/dev/null || echo "{}")
+  CURRENT_DESC=$(printf '%s' "$REPO_DATA" | jq -r '.description // ""')
+
+  # Skip if already marked
+  if [[ "$CURRENT_DESC" == "[MIRROR]"* ]]; then
+    log_info "GitHub repo ${repo} already marked as mirror — skipping"
     continue
   fi
 
-  # Get original description to preserve it
-  ORIGINAL_DESC=$(github_api GET "/repos/${GITHUB_USERNAME}/${repo}" 2>/dev/null | jq -r '.description // ""' || echo "")
-
-  # Build new description with moved notice
-  NEW_DESC="[MOVED] Now at https://${GITEA_DOMAIN}/${GITEA_ORG_NAME}/${repo}"
-  if [[ -n "$ORIGINAL_DESC" ]]; then
-    NEW_DESC="${NEW_DESC} — was: ${ORIGINAL_DESC}"
+  # Build new description preserving original
+  NEW_DESC="[MIRROR] Offsite backup — primary at https://${GITEA_DOMAIN}/${GITEA_ORG_NAME}/${repo}"
+  if [[ -n "$CURRENT_DESC" ]]; then
+    NEW_DESC="${NEW_DESC} — was: ${CURRENT_DESC}"
   fi
 
-  # Archive the repo with the new description
-  ARCHIVE_PAYLOAD=$(jq -n \
+  # Update description + homepage, disable wiki and projects
+  UPDATE_PAYLOAD=$(jq -n \
     --arg description "$NEW_DESC" \
-    '{archived: true, description: $description}')
+    --arg homepage "https://${GITEA_DOMAIN}/${GITEA_ORG_NAME}/${repo}" \
+    '{description: $description, homepage: $homepage, has_wiki: false, has_projects: false}')
 
-  if github_api PATCH "/repos/${GITHUB_USERNAME}/${repo}" "$ARCHIVE_PAYLOAD" >/dev/null 2>&1; then
-    log_success "Archived GitHub repo: ${repo}"
+  if github_api PATCH "/repos/${GITHUB_USERNAME}/${repo}" "$UPDATE_PAYLOAD" >/dev/null 2>&1; then
+    log_success "Marked GitHub repo as mirror: ${repo}"
   else
-    log_error "Failed to archive GitHub repo: ${repo}"
+    log_error "Failed to update GitHub repo: ${repo}"
   fi
+
+  # Disable GitHub Pages if enabled (Pages can incur bandwidth costs)
+  github_api DELETE "/repos/${GITHUB_USERNAME}/${repo}/pages" >/dev/null 2>&1 || true
 done
 
 # ---------------------------------------------------------------------------
@@ -306,4 +316,4 @@ done
 # ---------------------------------------------------------------------------
 printf '\n'
 log_success "Phase 8 complete — Gitea is live at https://${GITEA_DOMAIN}"
-log_info "GitHub repos have been archived. Gitea is now the primary git host."
+log_info "GitHub repos marked as offsite backup. Push mirrors remain active."