fix(dev-fresh): keyless launch no longer crashes on stock macOS bash 3.2 (#144)

Expanding the empty KEY_SETUP_EXTERNAL_KEYS array under set -u is a fatal
'unbound variable' on bash 3.2, which macOS ships as /bin/bash — so a keyless
./scripts/dev-fresh.sh died at the provenance-marker line before doing
anything. The ${arr[*]:-} guard keeps 3.2 alive and leaves populated launches
byte-identical (same idiom the script already uses for DEV_UNSET).

Verified with /bin/bash 3.2.57: the extracted block runs clean under set -u
with no keys (empty CSV) and with keys (ordered comma-joined names); the full
launcher boots keyless to a live server, and exported keys still classify as
externally managed in Provider Settings. A behavioral guard now runs the real
block from the script both ways in the dev-fresh test surface, plus a textual
assertion pinning the 3.2-safe idiom.

CHANGELOG.md

@@ -12,6 +12,10 @@ of current runtime behavior, see [`docs/CURRENT-STATE.md`](docs/CURRENT-STATE.md
   the two largest sources and dropped them entirely — leaving roughly a third of
   global detections while reporting each dropped source twice, once as
   successful with its real count and once as failed.
+- `./scripts/dev-fresh.sh` no longer crashes on stock macOS bash 3.2 when no
+  provider keys are exported: expanding the empty external-keys provenance
+  array under `set -u` was fatal there. Launches with exported keys are
+  unchanged.
 
 ### Security