internal/rosa: stricter cure-script options

This change also moves .cure-script out of /system/bin.

Signed-off-by: Ophestra <cat@gensokyo.uk>

internal/rosa/rosa.go

@@ -218,7 +218,7 @@ func fixupEnviron(env, extras []string, paths ...string) []string {
 
 // absCureScript is the absolute pathname [Toolchain.New] places the fixed-up
 // build script under.
-var absCureScript = AbsSystem.Append("bin", ".cure-script")
+var absCureScript = AbsSystem.Append(".cure-script")
 
 const (
 	// TExclusive denotes an exclusive [pkg.Artifact].
@@ -348,7 +348,7 @@ mkdir -vp /work/system/bin
 			support...,
 		), pkg.Path(
 			absCureScript, false,
-			pkg.NewFile(".cure-script", []byte("set -e\n"+script)),
+			pkg.NewFile(".cure-script", []byte("set -eu -o pipefail\n"+script)),
 		)}, paths)...,
 	)
 }