[EPIC] lib.sh hardening audit (F2 round)

gh issue create --title "[EPIC] lib.sh hardening audit (F2 round)" --label "epic,security,audit" --body "## EPIC: lib.sh hardening audit (F2 round)

Source: F2 audit round, 2026-09-03. 7 sub-agents explored the repo in parallel; this EPIC aggregates the 18 findings from the lib.sh audit (1 CRITICAL, 3 HIGH, 8 MEDIUM, 6 LOW).

Critical and High items are RCE-class bugs in the credential path; they should land in v2.11.3. Medium and Low items are hardening / hygiene and can be batched into a follow-up release.

### CRITICAL

- [ ] #171 lib.sh CRIT-1 — validate 7 unvalidated INPUT_* before they flow into lftp -e (RCE via !cmd escape)

### HIGH

- [ ] #172 lib.sh HIGH-1/3 — reject double-quote in validate_path / validate_lftp_settings; quote MIRROR_COMMAND -x/-X
- [ ] #173 lib.sh HIGH-2 — stale-recovery DELE only deletes the first sentinel; orphan sentinels accumulate

### MEDIUM

- [ ] #160 validate_lftp_settings rejects '!' from INPUT_EXCLUDE/INPUT_EXCLUDE_DELETE (existing; F2 added detail)
- [ ] #174 lib.sh MED-2 — validate_path allows spaces; breaks -e shell parsing
- [ ] #175 lib.sh MED-3 — CHANGELOG v2.11.2 #131 entry rewritten (CLOSED, done by PR #170)
- [ ] #176 lib.sh MED-4 — race window between PUT-in-progress and stale-recovery can leave two live sentinels
- [ ] #177 lib.sh MED-5 — _lock_sentinel_name doesn't validate args
- [ ] #178 lib.sh MED-6 — acquire_lock_with_recovery mktemp fallback uses predictable PID-based path
- [ ] #179 lib.sh MED-7 — compute_backoff_seconds depends on \$RANDOM (busybox ash extension)
- [ ] #180 lib.sh MED-8 — validate_int accepts absurdly large values

### LOW

- [ ] #181 lib.sh LOW-1 — print_inputs_dump debug output uses different order than action.yml
- [ ] #182 lib.sh LOW-2 — extract_netrc_host has no tests for URL with query/fragment or IPv6 zone-id
- [ ] #183 lib.sh LOW-3 — validate_int accepts leading zeros (octal trap)
- [ ] #184 lib.sh LOW-4 — mktemp body file in acquire_lock_with_recovery doesn't guarantee mode 0600
- [ ] #185 lib.sh LOW-5 — extract_netrc_host with query/fragment gives wrong hostname
- [ ] #186 lib.sh LOW-6 — RANDOM % (_cb_delay + 1) off-by-one for even delays (cosmetic)

## Suggested resolution order

1. Land CRIT-1 + HIGH-1 + HIGH-2 in a single v2.11.3 PR (they share the validator code).
2. Batch the MEDIUMs that share a code area (MED-4 with HIGH-2; MED-5 with HIGH-2; MED-7 with LOW-6).
3. Batch the LOWs into a v2.11.4 cleanup release.

## Source

F2 audit 2026-09-03 (lib.sh audit). Reporter: subagent-pekodbj7."