Guard the vendoring script against an unset VENDOR_DIR

The script rm -rf's $VENDOR_DIR early, so its assignment has to be
bulletproof: overridable from the environment, falling back to the
plugin's own vendor/, and refusing to run any deletion while it still
resolves empty.

vendor_chattolib.sh

@@ -14,11 +14,14 @@
 #   ./vendor_chattolib.sh                       # all default platforms
 #   PLATFORMS="linux-x86_64" ./vendor_chattolib.sh
 #   CHATTOLIB_SPEC="chattolib==0.4.20" ./vendor_chattolib.sh
+#   VENDOR_DIR="/tmp/vendor-alt" ./vendor_chattolib.sh
 
 set -euo pipefail
 
 PLUGIN_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-VENDOR_DIR="$PLUGIN_DIR/vendor"
+# Overridable from the environment; unset or empty falls back to the plugin's
+# own vendor/ so neither `set -u` nor a stray empty value can break startup.
+VENDOR_DIR="${VENDOR_DIR:-$PLUGIN_DIR/vendor}"
 BUILD_DIR="$(mktemp -d)"
 trap 'rm -rf "$BUILD_DIR"' EXIT
 
@@ -79,6 +82,9 @@ for tag in "${PLATFORM_LIST[@]}"; do
 done
 
 echo "🧹 Bereinige alten vendor-Ordner..."
+# Guard before the destructive step: this script must never run rm -rf with
+# an empty or unset target, whatever future edits do to the assignment above.
+: "${VENDOR_DIR:?VENDOR_DIR ist nicht gesetzt — Abbruch vor rm -rf}"
 rm -rf "$VENDOR_DIR"
 mkdir -p "$VENDOR_DIR"