[EPIC] lib.sh hardening audit (F2 round)

gh issue create --title "[EPIC] lib.sh hardening audit (F2 round)" --label "epic,security,audit" --body "## EPIC: lib.sh hardening audit (F2 round)

Source: F2 audit round, 2026-09-03. 7 sub-agents explored the repo in parallel; this EPIC aggregates the 18 findings from the lib.sh audit (1 CRITICAL, 3 HIGH, 8 MEDIUM, 6 LOW).

Critical and High items are RCE-class bugs in the credential path; they should land in v2.11.3. Medium and Low items are hardening / hygiene and can be batched into a follow-up release.

### CRITICAL

- [ ] #171 lib.sh CRIT-1 — validate 7 unvalidated INPUT_* before they flow into lftp -e (RCE via !cmd escape)

### HIGH

- [ ] #172 lib.sh HIGH-1/3 — reject double-quote in validate_path / validate_lftp_settings; quote MIRROR_COMMAND -x/-X
- [ ] #173 lib.sh HIGH-2 — stale-recovery DELE only deletes the first sentinel; orphan sentinels accumulate

### MEDIUM

- [ ] #160 validate_lftp_settings rejects '!' from INPUT_EXCLUDE/INPUT_EXCLUDE_DELETE (existing; F2 added detail)
- [ ] #174 lib.sh MED-2 — validate_path allows spaces; breaks -e shell parsing
- [ ] #175 lib.sh MED-3 — CHANGELOG v2.11.2 #131 entry rewritten (CLOSED, done by PR #170)
- [ ] #176 lib.sh MED-4 — race window between PUT-in-progress and stale-recovery can leave two live sentinels
- [ ] #177 lib.sh MED-5 — _lock_sentinel_name doesn't validate args
- [ ] #178 lib.sh MED-6 — acquire_lock_with_recovery mktemp fallback uses predictable PID-based path
- [ ] #179 lib.sh MED-7 — compute_backoff_seconds depends on \$RANDOM (busybox ash extension)
- [ ] #180 lib.sh MED-8 — validate_int accepts absurdly large values

### LOW

- [ ] #181 lib.sh LOW-1 — print_inputs_dump debug output uses different order than action.yml
- [ ] #182 lib.sh LOW-2 — extract_netrc_host has no tests for URL with query/fragment or IPv6 zone-id
- [ ] #183 lib.sh LOW-3 — validate_int accepts leading zeros (octal trap)
- [ ] #184 lib.sh LOW-4 — mktemp body file in acquire_lock_with_recovery doesn't guarantee mode 0600
- [ ] #185 lib.sh LOW-5 — extract_netrc_host with query/fragment gives wrong hostname
- [ ] #186 lib.sh LOW-6 — RANDOM % (_cb_delay + 1) off-by-one for even delays (cosmetic)

## Suggested resolution order

1. Land CRIT-1 + HIGH-1 + HIGH-2 in a single v2.11.3 PR (they share the validator code).
2. Batch the MEDIUMs that share a code area (MED-4 with HIGH-2; MED-5 with HIGH-2; MED-7 with LOW-6).
3. Batch the LOWs into a v2.11.4 cleanup release.

## Source

F2 audit 2026-09-03 (lib.sh audit). Reporter: subagent-pekodbj7."

This epic covers 18 findings in lib.sh, with the critical and high-priority work tracked in issues #171, #172, and #173. Start by reading those linked issue descriptions and the affected validator, credential, and stale-recovery paths in lib.sh. Done means the selected findings are fixed, their relevant checks are covered, and the v2.11.3 hardening work is ready to land.

Written by the indexing model from the issue text.