fix: resolve 17 confirmed bash-parity drifts from port review

Adversarial parity review of every ported action against its bash source
confirmed 17 real behavioral drifts (of 22 claimed); all fixed here:

- tiers/chown: defaults were compositions/apex/tierN (one level too deep);
  now the tier roots. shared/ base reset is non-recursive again.
- compose: --dry-run was swallowed by argparse.REMAINDER; now stripped.
- host.write_file: rendered files land 0644 (tempfile's 0600 made fresh
  systemd units/crowdsec configs owner-only).
- systemd.deploy_units: top-level non-hidden files only.
- ufw: missing docker/host config dir exits 66; missing /etc/ufw target
  aborts; empty rules dir warns; dotfile .rules excluded.
- sync/packages: Telegram error-trap parity and failed notify exits 1.
  Same notify-failure exit for backup/run and sync/repository.
  repository regains the node-dir guard.
- tiers/useradd: no more secret-bearing .env.bak per run.
- tiers/link: EOF on confirm prompt declines and continues.
- extract-traefik-certs: sudo mkdir inside the notify envelope.
- generate-happ-subscriptions: realpath parent-exists guards + docker check.
- configure/crowdsec: bouncer install goes through install_packages.
- lint-docker-compose: malformed/unreadable anchor-IP inputs are lint errors.
- core compose: APEX_RESTIC_REPOSITORY now ?error; RESTIC_COMPRESSION
  per-node via APEX_RESTIC_COMPRESSION (default auto).
- sys.service_exists line-anchored; tpl docstring corrected.

engine/lib/ufw.py

@@ -26,12 +26,22 @@ class Ufw:
     def _inject_file(self, target: str, source_file: str, dry_run: bool):
         if not os.path.isfile(source_file):
             return
+        if not self.sys.ok(["sudo", "test", "-f", target]):
+            self.log.error(f"Target file does not exist: {target}")
+            raise SystemExit(1)
         content = "\n".join(clean_rules(open(source_file).read()))
         self.host.inject_block(target, content, APEX_START, APEX_END,
                                anchor="# End required lines", old_pairs=OLD_PAIRS,
                                dry_run=dry_run, sudo=True)
 
     def apply(self, rules_dir: str, config_dir=None, dry_run: bool = False) -> None:
+        # EX_NOINPUT guards first, tools second — same order/codes as root_template_ufw.
+        if not os.path.isdir(rules_dir):
+            self.log.error(f"Rules directory does not exist: {rules_dir}")
+            raise SystemExit(66)
+        if config_dir and not os.path.isdir(config_dir):
+            self.log.error(f"Config directory does not exist: {config_dir}")
+            raise SystemExit(66)
         if not self.sys.ok(["sudo", "ufw", "--version"]):
             self.log.error("ufw not installed/working via sudo. Run configure/base first.")
             raise SystemExit(1)
@@ -51,16 +61,17 @@ class Ufw:
             self._inject_file("/etc/ufw/before.rules", os.path.join(config_dir, "before.rules"), dry_run)
             self._inject_file("/etc/ufw/after.rules", os.path.join(config_dir, "after.rules"), dry_run)
 
-        if os.path.isdir(rules_dir):
-            for fn in sorted(os.listdir(rules_dir)):
-                if not fn.endswith(".rules"):
-                    continue
-                for rule in clean_rules(open(os.path.join(rules_dir, fn)).read()):
-                    self.log.info(f"Applying ufw-docker rule ({fn}): {rule}")
-                    if dry_run:
-                        self.log.info(f"[DRY-RUN] sudo {UFW_DOCKER_BIN} {rule}")
-                    else:
-                        self.sys.run(["sudo", UFW_DOCKER_BIN, *rule.split()], check=True)
+        rule_files = [fn for fn in sorted(os.listdir(rules_dir))
+                      if fn.endswith(".rules") and not fn.startswith(".")]
+        if not rule_files:
+            self.log.warn(f"No .rules files found in {rules_dir}, nothing to apply.")
+        for fn in rule_files:
+            for rule in clean_rules(open(os.path.join(rules_dir, fn)).read()):
+                self.log.info(f"Applying ufw-docker rule ({fn}): {rule}")
+                if dry_run:
+                    self.log.info(f"[DRY-RUN] sudo {UFW_DOCKER_BIN} {rule}")
+                else:
+                    self.sys.run(["sudo", UFW_DOCKER_BIN, *rule.split()], check=True)
 
         self.log.success("All ufw rules applied.")
         self.log.warn("Run `sudo systemctl restart ufw` to apply. Ensure ssh is allowed via plain ufw!")