verify-backends: grep -q in a pipe under pipefail can report false failures #597

Summary

scripts/verify-backends runs under set -uo pipefail and still pipes output into grep -q in two places. grep -q exits on its first match; if the writer is still producing output it dies of SIGPIPE (141), and pipefail turns the match into a failure. This is the bug fixed for acq.backends/ in #516 (section 45 of docs/KNOWN_FAILURE_MODES.md), where it caused intermittent false "no ssh-agent route" warnings.

Affected call sites

• scripts/verify-backends:906: msb volume ls -q 2>/dev/null | grep -q "^acq-${name}-"
• scripts/verify-backends:1112: printf "%s\n" "$out" | grep -qF "$body"

Both inputs are small (a volume list, one command's output), so a false result is unlikely, but when it happens a live verification run reports a failure that isn't real.

The other verify-* helpers (verify-issue-320, verify-ports-live, verify-net-default-egress, verify-msb-pin, verify-sbx-startup-barrier) use the same pattern but run with set -u only, so they are not affected. verify-backends:738 pipes into grep -q inside a guest sh -c command, which does not set pipefail.

Proposal

Match against captured output with a here-string, as acq.backends/ now does:

listed=$(msb volume ls -q 2>/dev/null) && grep -q "^acq-${name}-" <<<"$listed"
grep -qF "$body" <<<"$out"

Related

#516 and its fix in #598.