fix: add EXIT trap to ensure encryption flag and temp files are cleaned up on crash

recover_bad_signature.sh

@@ -148,6 +148,8 @@ restore_encryption_flag() {
 clean_up() {
 
    # Perform program exit housekeeping
+   # Clear EXIT trap first so that the exit below does not fire it again.
+   trap - EXIT
    restore_encryption_flag
    [[ -n "$recovery_php_file" ]] && rm -f "$recovery_php_file" 2> /dev/null
    rm -rf "$LOCK_DIR"
@@ -1179,7 +1181,10 @@ su -c "$PHP_BIN $INSTALL_DIR/occ config:system:set encryption_skip_signature_che
 if [[ $? -eq 0 ]] ; then
    echo_ok
    _encryption_flag_changed=true
-   trap 'restore_encryption_flag; clean_up 1' SIGHUP SIGINT SIGTERM
+   # Trap signals AND normal/abnormal exit so that the encryption flag
+   # and temp files are always cleaned up — even on a syntax error or
+   # an unexpected crash (EXIT fires for any bash exit, including errors).
+   trap 'clean_up 1' SIGHUP SIGINT SIGTERM EXIT
 else
    echo_failed
    fatal "Could not enable encryption_skip_signature_check: $(cat "$log_file")"