security: shell-quote interpolated values in guest command strings

[ErenAri]

Addresses the three GitHub Code Quality (AI) findings on internal/vm/qemu.go. All three flag the same theme: guest command strings are assembled by string concatenation, relying on upstream manifest/profile validation rather than explicit shell-quoting.

Since these commands run through sshRun as a single shell string, exec.Command-style separate args can't avoid the shell — the correct hardening is to single-quote every interpolated operand. This is defense-in-depth: a validation gap can no longer turn an interpolated value into shell syntax.

Changes

• Reuse the existing shellQuote helper (previously only used by virtme_ng.go) across the qemu run path:
  • validator run command — validator/artifact/manifest/functional-plan/out/log-dir/stderr/exit paths and attach-mode each single-quoted
  • mapFixupArgs / progTypeArgs / progVariantArgs / --probe-companions operands quoted
  • guestKernelInstallCmd — kernel release string and .deb package URLs quoted
• Documented shellQuote's escaping contract; added TestShellQuote (embedded single quotes + $(...), ;, #).
• Updated the arg-builder test expectations to the quoted form.

Notes

• All values remain validated upstream — this is belt-and-suspenders, not a fix for a known-exploitable path.
• No behavior change for valid inputs: the guest shell strips the added quotes, so the validator receives identical arguments.
• Scope is the live VM-runner path (not the frozen runtime agent).

Verification

go build, go vet, go test ./... all green; gofmt clean.

🤖 Generated with Claude Code