[Infrastructure] Shell scripts: no error handling in install.sh, unvalidated input, unsafe sed

[Flegma]

Summary

Shell scripts lack error handling and input validation.

Findings

• install.sh — no set -e, no error checking. Commands continue on failure.
• setup-env.sh — domain names from read with no format validation. Used in sed.
• replace_rand32_in_env_files.sh — random string can contain sed special chars. No escaping.

Impact

Partial installations in broken state. Invalid domains or malformed .env files.

Suggested Fix

Add set -euo pipefail and trap to all scripts. Validate domain input. Escape sed values or use envsubst.

[Flegma]

Closed by #428 (merged 2026-04-24).