Harden release scripts: fix metadata parsing, passphrase scoping, and path safety

[thomasbuilds]

• Fix generate-metadata OTA metadata parsing

  • Replace unbounded split("=") with partition("="), which handles build fingerprints and other values that contain =.
  • Use post-build-incremental directly instead of indexing into post-build; add required-field validation for post-build-incremental, post-timestamp, and pre-device.

• Add strict shell failure handling to generate-keys

  • Enables errexit, nounset, and pipefail.
  • Quotes path and array expansions in the key generation loop.

• Avoid exporting key passphrases broadly

  • decrypt-keys and encrypt-keys scope passphrase variables to the specific openssl invocations that need them via env "password=..." openssl ...; also fix cd $1 → cd "$1" and array/filename quoting in the key loops.
  • generate-release.sh and generate-delta.sh strip inherited passphrase export state, pass it only to decrypt-keys, then unset it.
  • generate-releases.sh and generate-deltas.sh no longer export the passphrase for their whole shell process.

• Quote release output paths in generate-release.sh

  • Quotes $RELEASE_OUT in rm -rf, mkdir, unzip -d, and cd.
  • Quotes $TARGET_FILES_INPUT when extracting OTA/android-info.txt.

• Remove unused AVB_PKMD assignment from generate-release.sh