security: treat launcher environment as untrusted data (SEC-VAL-INEVAL-2)

[asahaji]

Description

Mitigates PSB requirement SEC-VAL-INEVAL-2 for the public ISE Agent host tools. The requirement prohibits dynamically executing user-controlled commands or code and requires validation before untrusted values reach an interpreter.

The launcher previously sourced the customer-editable .env file in Bash to read ISE_AGENT_NETWORK_MODE. Shell substitutions or commands embedded in that file could therefore execute with the privileges of the user running the launcher. The update path also reused AGENT_ID in Compose template rendering without revalidating a modified .env.

This change:

• parses required .env values as plain data instead of sourcing the file;
• rejects duplicate keys so an attacker cannot exploit ambiguous configuration precedence;
• restricts network mode to the existing bridge/host allowlist;
• revalidates AGENT_ID before it influences Compose template rendering;
• fails closed before applying an unsafe host-tool update.

Why this satisfies SEC-VAL-INEVAL-2

The editable package configuration now crosses the shell trust boundary only through literal string parsing and explicit allowlists. It is never evaluated as Bash program text. Values that later influence an interpreter-like template operation are validated against the same constrained agent-ID grammar used during installation.

How Has This Been Tested?

• bash -n agentctl tests/test-host-tools.sh
• tests/test-host-tools.sh
• Added regressions proving a command-substitution payload is rejected and not executed.
• Added duplicate-key and unsafe-agent-ID rejection coverage.

Types of Changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)