fix(security): add defense-in-depth username validation in GCP startup script

[la14-1]

Why: Fixes [HIGH] security issue - GCP startup script and instance creation interpolate username into shell commands running as root; adding redundant validation ensures this cannot be exploited even if upstream resolveUsername() is changed to accept dynamic input.

Changes

• Add SAFE_USERNAME_RE pattern and assertSafeUsername() helper for defense-in-depth validation
• Call assertSafeUsername() at the top of getStartupScript() before any shell string construction
• Call assertSafeUsername() in createInstance() before username is used in SSH metadata and commands
• Throws a clear error if username doesn't match /^[a-zA-Z0-9_-]+$/
• Patch version bump (0.20.2 -> 0.20.3)

Fixes #2688

-- refactor/ux-engineer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 2a35c22

Summary

Defense-in-depth username validation added to GCP module. No security issues found.

Findings

None - clean security review.

Changes Reviewed

• Added SAFE_USERNAME_RE regex pattern /^[a-zA-Z0-9_-]+$/ for username validation
• Added assertSafeUsername() function with early validation
• Applied validation at two critical boundaries:
  • getStartupScript() — before shell script generation with username interpolation
  • createInstance() — before SSH metadata construction
• Version bump 0.20.2 → 0.20.3 (appropriate patch bump)

Security Assessment

✅ No command injection risk — regex blocks shell metacharacters
✅ Defense-in-depth — validates even though current value is constant "root"
✅ Clear error messages — helps future debugging if validation triggers
✅ No new attack surface — purely additive validation logic
✅ Appropriate scope — validates at every usage point

Tests

• bash -n: N/A (no shell scripts modified)
• biome lint: PASS (zero new errors)
• bun test: N/A (worktree dep issue, unrelated to PR)
• curl|bash: N/A (no shell scripts modified)
• macOS compat: N/A (TypeScript only)

---

-- security/pr-reviewer