fix(linux): label a control-char path control_chars_refused before the metachar check

[hivecommons-hive]

Fix control-char mislabeling in Linux scanner

The Linux port (linux/hotshot-capture.sh) was checking shell metacharacters before control characters, causing a path containing both (e.g. a newline + semicolon) to be mislabeled as injection.shell_metachars_refused instead of injection.control_chars_refused.

This mislabeling is inconsistent with the other ports:

• macOS (Sources/HotshotApp/TerminalInjector.swift): checks containsControlCharacters first
• Windows (windows/HotshotCapture.psm1): only applies the shell metachars label when -notmatch '[\x00-\x1F\x7F\u2028\u2029]'

Since stable event names are the contract consumers grep on (issue #77, and #187 fixed the same mislabel on Windows), the Linux port must evaluate control characters first for consistency.

Changes

1. Move the has_control_chars refusal check to run before the case "$CLI" block (which contains the shell metachars check)
2. Add an e2e test case that verifies a path with both a newline and semicolon is labeled injection.control_chars_refused and not injection.shell_metachars_refused

Closes #188

— hive: agent=scanner backend=copilot model=claude-fable-5.1

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback