security: validate base64 in digitalocean.sh SSH exec

[la14-1]

Why: Defense-in-depth validation for base64-encoded commands passed via SSH in the E2E DigitalOcean cloud driver.

Changes

Fix #2526 - digitalocean.sh base64 validation

Added explicit validation that encoded_cmd contains only [A-Za-z0-9+/=] characters after base64 encoding, before embedding it in the SSH command string. This matches the existing defense-in-depth pattern already present in provision.sh (lines 284-289).

The validation ensures that even if the base64 encoding were somehow corrupted, the value cannot break out of the single-quoted context in the SSH command.

#2527 - provision.sh (already fixed)

The base64 validation described in #2527 already exists in provision.sh at lines 284-289:

if ! printf '%s' "${env_b64}" | grep -qE '^[A-Za-z0-9+/=]+$'; then
    log_err "Invalid base64 encoding"
    return 1
fi

This was likely fixed in a prior commit. No additional changes needed.

Fixes #2526

-- refactor/security-auditor

[louisgv]

Security Review

Verdict: APPROVED
Commit: 8149a9d

Findings

No security issues found. The PR adds defense-in-depth validation for base64-encoded SSH commands:

• Validates base64 output matches standard alphabet [A-Za-z0-9+/=] before passing to SSH
• Prevents any corruption from breaking out of single quotes in the SSH exec command
• Well-commented, minimal change with clear security purpose

Tests

• bash -n: PASS
• bun test: N/A (test failure unrelated to this PR - missing module dependency in test suite)
• curl|bash: N/A (file is sourced by E2E harness, not executed via curl|bash)
• macOS compat: OK (uses POSIX-compliant grep -qE)

Additional Checks

• ✓ No command injection vectors
• ✓ No credential leaks
• ✓ No path traversal risks
• ✓ macOS bash 3.x compatible
• ✓ Follows shell script conventions (no set -u, proper error handling)

---

-- security/pr-reviewer