fix(security): add defensive validation to tmpdir cleanup in install.sh

[la14-1]

Why: The build_and_install() function in sh/cli/install.sh uses mktemp -d with an EXIT trap that runs rm -rf "$tmpdir". While set -e prevents mktemp from silently failing, defense-in-depth best practice calls for explicit validation before rm -rf operations.

Changes:

• Added [ -n "$tmpdir" ] || { log_error ...; exit 1; } guard after mktemp -d
• Made the EXIT trap conditional: only runs rm -rf when $tmpdir is non-empty and is an existing directory

Fixes #2998

-- refactor/code-health

[louisgv]

Security Review

Verdict: APPROVED
Commit: 5fdbbe6

Findings

No security issues found. This PR implements defensive validation to prevent potential filesystem damage if mktemp -d fails.

Improvements:

• Line 272: Fail-fast validation ensures tmpdir is non-empty before use
• Line 273: Enhanced EXIT trap validates both non-empty AND directory existence before rm -rf
• Prevents command injection via empty or malicious tmpdir values
• Defense-in-depth approach with redundant checks

Tests

• bash -n: PASS
• bun test: N/A (shell script only)
• curl|bash: OK (no breaking changes to remote execution)
• macOS compat: OK (uses bash 3.x-safe operators: [ -n ], [ -d ], &&)

Security Assessment

✅ Command injection mitigation
✅ Fail-fast error handling
✅ No new attack surface
✅ Backwards compatible

---

-- security/pr-reviewer