[EPIC] entrypoint.sh hardening audit (F2 round)

gh issue create --title "[EPIC] entrypoint.sh hardening audit (F2 round)" --label "epic,security,audit" --body "## EPIC: entrypoint.sh hardening audit (F2 round)

Source: F2 audit round, 2026-09-03. This EPIC aggregates the 9 findings from the entrypoint.sh audit (1 CRITICAL, 2 HIGH, 3 MEDIUM, 3 LOW).

The CRITICAL is a lock-release window during early-exit; should land in v2.11.3 alongside the lib.sh CRIT-1 (they are in the same RCE/credential-leak class). HIGH-2 is an unbounded-runtime bug; HIGH-1 is a retry-classification gap that complements #138.

### CRITICAL

- [ ] #188 entrypoint.sh C1 — EXIT trap releases concurrency lock BEFORE acquire returns (window 222->261)

### HIGH

- [ ] #138 TLS/handshake errors not classified as permanent (existing; F2 added detail; continuation of #138)
- [ ] #189 entrypoint.sh H2 — INPUT_MAX_RETRIES=0 + 5h timeout per attempt = unbounded total runtime

### MEDIUM

- [ ] #190 entrypoint.sh M1 — INPUT_SERVER not validated with validate_path; raw value flows into lftp -e
- [ ] #191 entrypoint.sh M2 — GITHUB_OUTPUT write aborts the rest of the script
- [ ] #192 entrypoint.sh M3 — /home/lftp/.lftp-logs grows unbounded across runs

### LOW

- [ ] #193 entrypoint.sh L1 — lftp log file is truncated on each retry; should append
- [ ] #194 entrypoint.sh L2 — print_resolved_config is not gated by INPUT_DEBUG
- [ ] #195 entrypoint.sh L3 — INPUT_SERVER with user:pw@ embedded makes lftp ignore .netrc

## Suggested resolution order

1. Land C1 in v2.11.3 with the lib.sh CRIT-1 (same credential-exfil class).
2. Land H2 + the permanent-error classifier (F2 detail on #138) together in v2.11.3.
3. Batch MEDIUMs into v2.11.4.
4. LOWs into a later cleanup release.

## Source

F2 audit 2026-09-03 (entrypoint.sh audit). Reporter: subagent-pekodbj7."

Start by reading entrypoint.sh and the linked findings #188-#195, with #138 as the existing related issue; lib.sh CRIT-1 is also named as a release companion. Done means the nine audit findings are addressed through their individual issues and landed in the stated v2.11.3, v2.11.4, or later cleanup order.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.