Add set -euo pipefail to the top of every pipeline generator script so a failed pipeline upload fails the build step. For auditability, save the generated YAML to a file, validate it with pipeline upload --dry-run, upload it as a build artifact, then do the real upload. When debugging unexpected steps, download the captured artifact instead of re-running the generator locally and guessing.

Context: Official Buildkite dynamic pipelines docs: in a dynamic pipeline, a rejected pipeline upload (invalid YAML, validation error) or transient failure happens mid-build while it is already running. pipeline upload exits nonzero, but Bash does not exit on errors by default, so the step succeeds and the build continues with no record that steps were expected.