fix(install.sh): validate EMAIL against shell/XML injection (PILOT-245) (#175)

${EMAIL} is written unquoted into systemd ExecStart= and unescaped
into macOS plist <string> elements. A malicious email containing
shell metacharacters (spaces, semicolons, pipes) or XML metacharacters
(<, >, &) can inject additional command-line arguments or break out
of the plist structure.

Fix: validate EMAIL against ^[A-Za-z0-9@._+-]+$ after resolution
and refuse install with a clear error if it contains unsafe characters.

Closes PILOT-245

Author: matthew-pilot

install.sh

@@ -185,6 +185,15 @@ if [ -z "$EMAIL" ] && [ ! -x "$BIN_DIR/pilotctl" ]; then
     fi
 fi
 
+# --- Validate email (prevent shell/XML injection) ---
+
+if [ -n "$EMAIL" ]; then
+    if ! echo "$EMAIL" | grep -qE '^[A-Za-z0-9@._+-]+$'; then
+        echo "  Error: EMAIL contains invalid characters (only A-Z a-z 0-9 @ . _ + - allowed)"
+        exit 1
+    fi
+fi
+
 # --- Detect existing installation ---
 
 UPDATING=false