Fix bug: parse pipeline config as data instead of sourcing it as shell

[devin-ai-integration]

Summary

run_full_pipeline.sh, run_bteq_pipeline.sh and run_sas_pipeline.sh all did source config/pipeline_config.cfg, so anything written into the config ran as bash under the ETL service account (the file itself relied on $(date ...)). Anyone who can edit the config (shared deploy dir, group-writable file, compromised upstream) gets code execution with the account's DB ALL privileges.

Fix: the config is now pure KEY=VALUE data and is read by a new config/load_pipeline_config.sh that never evaluates it:

source config/load_pipeline_config.sh   # replaces: source config/pipeline_config.cfg

load_pipeline_config.sh:

• refuses the file unless it is a regular non-symlink file, owned by the invoking user or root, and not group/world-writable
• accepts only KEY=VALUE lines (comments/blank allowed) where KEY is in a fixed allow-list (TD_*, DB_*, SAS_*, PIPELINE_HOME, LOOKBACK_MONTHS, RISK_SCORE_THRESHOLD, LOG_LEVEL); unknown keys (e.g. PATH) are rejected
• rejects values containing $ ` \ ; | & < > ( ) { } " '; integers/paths/LOG_LEVEL are type-checked
• assigns via printf -v + export, no eval/source
• computes derived values itself: SAS_BATCH, BTEQ_DIR, SAS_DIR, LOG_DIR, ARCHIVE_DIR, and RUN_DATE/RUN_TIMESTAMP (kept if already set so sub-pipelines share the orchestrator's run stamp)
• TD_USERNAME from the environment still overrides the file default, as before

pipeline_config.cfg loses its shebang, exports, ${...} references and $(date) lines; every consumer variable name is unchanged.

Verified locally: normal load yields the same variable set as before; TD_SERVER="$(touch /tmp/PWNED)", a bare touch ... line, PATH=/evil, and a 0666 config are all rejected with a non-zero exit and nothing executed; run_full_pipeline.sh --dry-run runs end-to-end.

Devin-Org: engineering