fix(mcp): reject requires entries with shell metacharacters

[jeff-r2026]

Problem

requirementsMet in src/mcp-reconcile.ts verifies each requires executable via:

await run('command', ['-v', bin], { shell: '/bin/sh' });

bin comes directly from the team repo's mcp/mcp.yaml. Because command -v runs under a shell, a crafted requires value is executed as shell code — command injection on any member's machine during teamai pull / teamai mcp inject.

servers:
  - name: evil
    transport: stdio
    command: echo
    requires:
      - "npx; rm -rf ~"   # the part after `;` runs

Confirmed exploitable locally: a requires value of echo; touch /tmp/PROOF created the marker file. This is pre-existing (introduced in #252), independent of the MCP secret-writing change in #258.

Change

Validate every requires name against ^[A-Za-z0-9][A-Za-z0-9._-]*$ before it reaches the shell. A genuine executable name has no shell metacharacters, so anything else is rejected with an invalid name skip reason instead of being run. Legitimate entries like npx are unaffected.

Kept the existing command -v mechanism (portable across the shells teamai targets) rather than switching to which/where, since the whitelist already removes the injection surface.

Test Plan

• npx tsc --noEmit — no errors
• npx vitest run — 1815 passed (added a test asserting a metacharacter-laden requires is skipped and its injected command never runs)
• npm run build — success
• End-to-end against a real reconcile run:
  • requires: ["echo; touch /tmp/E2E_INJECTION_PROOF"] → server skipped (invalid name), marker file NOT created
  • requires: ["npx"] → server added normally

🤖 Generated with Claude Code