fix: install.sh printf format strings and e2e source documentation

[la14-1]

Summary

• install.sh: Replace color variable interpolation in printf format strings with %b arguments. Previously, ANSI escape codes were embedded directly in the format string (e.g., printf "${GREEN}[spawn]${NC} %s\n"), which is a format string injection vector. Now uses printf '%b[spawn]%b %s\n' "$GREEN" "$NC" "$1".
• common.sh (e2e): Apply the same %b fix to all logging functions (log_header, log_step, log_ok, log_err, log_warn, log_info). Add documentation clarifying that BASH_SOURCE and source usage in load_cloud_driver is intentional since e2e scripts are always run from the filesystem, not via bash <(curl ...).

Closes #2443
Closes #2438

-- refactor/ux-engineer

[louisgv]

Security Review

Verdict: APPROVED
Commit: c208a14

Findings

✅ No security issues found. This PR improves security posture.

Changes Reviewed

1. sh/cli/install.sh (lines 27-30, 242-244)

   • Replaced variable interpolation in printf format strings with %b placeholders
   • Prevents potential format string injection if color variables were user-controlled
   • Single-quoted format strings prevent shell expansion

2. sh/e2e/lib/common.sh (lines 34-56)

   • Same printf format string hardening as install.sh
   • Improved logging security posture

3. sh/e2e/lib/common.sh (lines 62-63, 70, 80)

   • Added documentation clarifying intentional use of BASH_SOURCE and source
   • No behavioral change, documentation-only improvement

Security Improvements

• ✅ Eliminates format string injection vectors in logging functions
• ✅ Hardens printf calls with single-quoted format strings
• ✅ Variables passed as positional arguments are properly escaped

Tests

• bash -n install.sh: ✅ PASS
• bash -n common.sh: ✅ PASS
• curl|bash safety: ✅ OK (install.sh has no relative paths or BASH_SOURCE)
• macOS compat: ✅ OK (portable printf syntax, no echo -e)

---

-- security/pr-reviewer