[LM-467] fix(maven): merge Endor server/mirror into existing settings…

[Mahesh-Kete]

LM-467 Merge-aware Maven settings.xml + config-writer hardening (bash)

What this PR does

1. Merge-aware settings.xml writer (c55ab09) — the original LM-467 change. Maven's schema forbids duplicate <servers>/<mirrors> containers, so the Endor <server>/<mirror> entries are now wrapped in per-entry sentinel markers and merged into whichever containers already exist (inserted as first child so the Endor catch-all mirror wins precedence); containers are created in schema order only when absent. Legacy combined-block files from older script versions are still recognized and migrated on re-run/removal.

2. Four bug fixes in lib/common.sh (58b5c16) — found during a full scan of the shared runtime library:

Bug	Fix
Data loss on files without a trailing newline. upsert_block glued the BEGIN sentinel onto the file's last line; the substring-based strip on re-run/removal then silently deleted that user line (or the whole file).	The file is newline-terminated before appending, so the marker always gets its own line.
Silent no-op on empty/malformed settings.xml. A file that existed but was empty (or had no </settings>) gave the insert logic no anchor line — the Endor entries were silently dropped while the script reported success, leaving the Maven firewall unenforced with a false green in the MDM console.	Empty/whitespace-only file → treated as absent (create from scratch). Non-empty file without </settings> → loud stderr ERROR + rc 1, which aborts the set -euo pipefail script so the MDM console shows a real failure. DRY_RUN reports CREATE/FAIL accordingly.
Removal could delete a settings.xml that still held user settings. The "anything real left?" whitelist regex missed legitimate elements like <offline>/<interactiveMode>, so a file containing only those was rm -f'd on uninstall.	The delete-if-empty heuristic is removed entirely: removal only strips the Endor sentinel entries and always preserves the file, containers, and all user content.
Root-owned config directories. MDM runs the scripts as root; mkdir -p left newly created dirs (worst: ~/.m2, potentially ~/.config) owned root:wheel 755. The user could read but not write inside — so Maven later failed to create ~/.m2/repository ("Could not create local repository") and every build died, weeks after a green install.	New _endor_mkdir_owned helper: records the topmost path segment that didn't exist, mkdir -ps, then chown -Rs only that newly created segment to the console user. Pre-existing directories are provably never touched; no-op when the chain already exists.

Design decisions

• Pre-provisioning: configs are written even when the ecosystem isn't installed — a config file without its tool is inert, protection is in place before first use, and tool detection from root's context is unreliable (SDKMAN/IDE-bundled installs are invisible to root's PATH).
• User owns everything: no root-owned/read-only "protection" of managed files. User-level config is low in every package manager's precedence order (CLI flags/env vars/project files override it), so read-only files would only fake enforcement while locking users out of their own settings. Enforcement = idempotent re-runs converging drift; guaranteed no-bypass belongs at the network layer.
• Removal never deletes settings.xml: an emptied <servers></servers>/<mirrors></mirrors> skeleton left behind is valid, no-op XML — a fair price for never risking user config.

Testing

Verified with a 41-assertion harness exercising the library directly: fresh create, re-run idempotency, merge into existing/self-closed/single-line containers, Endor-mirror-first precedence, legacy block migration, empty & malformed settings.xml, install→remove→reinstall round-trip, newline-less flat files, and directory-ownership behavior (via chown-call interception: recursive chown lands on exactly the topmost newly created segment; never on pre-existing dirs).

Follow-ups (not in this PR)

• bash/out/ embeds this library at generation time — regenerate via generate.sh so deployed scripts pick up the fixes.