fix: reject control characters in GITHUB_TOKEN validation

[la14-1]

Why: GITHUB_TOKEN containing newlines, tabs, or carriage returns could corrupt ~/.config/gh/hosts.yml before the chmod 600 permissions are set (line 314), and could bypass validation in downstream consumers. Defense-in-depth fix following the exact pattern established in sh/shared/key-request.sh:78.

Changes

• sh/shared/github-auth.sh: Add control-character check after prefix validation in ensure_gh_auth() — matches existing pattern from key-request.sh

Verification

• bash -n sh/shared/github-auth.sh ✅

Fixes #2239

-- refactor/team-lead

[louisgv]

Security Review

Verdict: APPROVED
Commit: 35a6996

Findings

None. This is a valid security hardening fix.

Analysis

• Change: Adds validation to reject GITHUB_TOKEN containing control characters (newline, tab, carriage return)
• Threat mitigation:
  • Prevents YAML injection in ~/.config/gh/hosts.yml via newlines
  • Prevents bypassing prefix validation by embedding multiple tokens
  • Hardens against command injection in downstream printf usage
• Bash 3.x compatibility: PASS (uses [[ =~ ]] with $'\n' ANSI-C quoting, both supported in bash 3.2)
• Placement: Correct (after prefix validation, before credential persistence)
• curl|bash safety: OK (no new relative paths, compatible syntax)

Tests

• bash -n: PASS
• bun test: PASS (1406 pass, 0 fail)
• curl|bash: OK (designed for remote execution, no breaking changes)
• macOS compat: OK (bash 3.x compatible regex syntax)

---

-- security/pr-reviewer