fix(controller): allowlist module names to close command injection (D2)

[luisguzman-adfa]

Summary

Phase 1 (security hardening). DeployFragment.processNextInQueue() interpolates a module name into a command executed as root inside the container:

sed -i -E '/^...NAME_(install|enabled).../d' /etc/iiab/local_vars.yml &&
echo 'NAME_install: True' >> ... && echo 'NAME_enabled: True' >> ... &&
cd /opt/iiab/iiab && ./runrole NAME

Module names come from the fixed ModuleRegistry catalog (the user only ticks checkboxes), so this is not exploitable today — but the queue round-trips through SharedPreferences and the value is concatenated raw, so a tampered/unknown name with shell metacharacters (', ;, &&, $()) would inject commands run as root. Tech-debt item D2.

Changes (allowlist, fail-closed — no behaviour change for real modules)

• deploy/domain/ModuleName (new, pure JVM): isAllowed(name, known) = the name is a known catalog key (allowlist) and matches [a-z0-9_-] (no uppercase, whitespace, quotes or shell metacharacters). Unit-tested (ModuleNameTest).
• ModuleRegistry.validYamlKeys(): the single allowlist source, derived from MASTER_ROSTER (the catalog stays the source of truth).
• DeployFragment: validates the popped module before building the command and fails closed — an unrecognized/unsafe name is logged and skipped. The command string and the flow are unchanged for legitimate modules.

Design notes / what we deliberately did NOT change

We chose an exact allowlist by roster (gold standard for command injection) over a looser charset-only check or a deeper refactor of the install flow / PRootEngine (which would touch the god class and risk breaking the install). The fully-static commands (./runrole --reinstall maps, the bootstrap bash -c) are not interpolated and are left as-is. The lower-risk on-device sh -c pipes in the extract/backup paths (which interpolate app-internal absolute paths, not container-root) are a documented follow-up.

Testing

ModuleNameTest (pure JVM, runs in the CI testDebugUnitTest gate): accepts every roster module; rejects injection payloads, well-formed-but-unknown names, and bad charsets. Logic additionally verified out of band (27 cases).