Seven LOW findings:

- mktemp (x3 at lines 403, 407, 723): || die if /tmp or SOURCEOS_DIR is full.

- sed -i (x2): || die on the sed command itself. The existing post-grep checks
  only catch "sed exited 0 but changed nothing"; a non-zero sed exit (e.g. disk
  full during in-place temp file write) would previously fire set -e silently.

- write_enroll_nix: wrap heredoc in { } || die and add || die to mv. Call site
  already had no guard because the function had no internal die calls.

- katello-sourceos-setup.sh: add existence check (|| die) before invoking it
  and || die on the bash call itself so API failures surface a clear message.

- _KATELLO_RUNNING / _KATELLO_FINAL docker ps pipelines: append || echo 0 so
  that a Docker daemon crash between `up -d` and the count check does not fire
  set -e silently; the count falls to 0 and the existing die guard triggers.

- printf > PLAINTEXT: || die on the write to the sops plaintext temp file.