fix: harden script robustness, security, and CI lint gates

Security & injection hardening:

- Add safeQuoteParam() and serializeParams() to safely quote all params

  file values, preventing shell injection when sourced

- Add validateParamsFile() with ownership (root) and permission (600/400)

  checks before sourcing the params file

- Validate CLIENT_NAME against ^[a-zA-Z0-9_-]+$ before sed interpolation

  in revokeClient() and regenerateClients() to prevent regex injection

Input validation & defensive checks:

- Reset all interactive variables in installQuestions() and manageMenu()

  to prevent pre-set environment variables from bypassing prompt loops

- Guard /etc/os-release with existence/readability check in checkOS()

- Guard VERSION_ID emptiness for all distro branches before comparison

- Extract major version via cut before -lt to handle point-release formats

- Add return-code check for serializeParams during install

IPv6 improvements:

- Add isValidIPv6() and normalizeIPv6() for robust IPv6 handling

- Normalize IPv6 at storage and comparison points to prevent duplicates

- Add semantic IPv6 duplicate detection for client creation

Migration (pre-2.0 to 2.0):

- Add migrateS3S4() and migrateH1H4() with validation and fallback

- Add persistMigration() with backup/restore, atomic writes, user

  confirmation, and old client config renaming

- Add quietIPv6Rewrite() for cosmetic IPv6 normalization without

  triggering migration warnings

Off-by-one fixes:

- Fix RANGE_SIZE arithmetic in generateH1AndH2AndH3AndH4Ranges()

  (use RANGE_SIZE - 1 for inclusive upper bounds)

Global state cleanup:

- Replace global HOME_DIR with local in getHomeDirForClient(),

  newClient(), revokeClient(), and regenerateClients()

- Declare RELEASE_YEAR, DEBIAN_MAJOR, FEDORA_MAJOR as local in checkOS()

UX consistency:

- Accept [yY] for uninstall confirmation, matching migration prompt

CI:

- Add nounset-check job (bash -u -n) to lint.yml to catch undefined

  variable regressions

Author: wiresock

.github/workflows/lint.yml

@@ -0,0 +1,35 @@
+name: Shell Lint
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  syntax-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Bash syntax check
+        run: bash -n amneziawg-install.sh
+
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install ShellCheck
+        run: sudo apt-get update && sudo apt-get install -y shellcheck
+
+      - name: Run ShellCheck
+        run: shellcheck --severity=error amneziawg-install.sh
+
+  nounset-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check for undefined variable regressions (set -u)
+        run: bash -u -n amneziawg-install.sh