fix(iac): a "}" or quote in the contact email breaks 8 generated deploy scripts (port the #991 bicep fix) #1436

What happens

Eight generated federation deploy scripts put the contact email into a shell default:

CONTACT_EMAIL="${CUDLY_CONTACT_EMAIL:-{{.ContactEmail}}}"

shellEscape (internal/api/handler_federation.go:447, and its copy in scripts/generate-federation-iac.go:200) escapes \, ", ` and $, but not }. A } in the address therefore ends the ${...:-...} default early. The rest of the address becomes literal text after it, and the script registers a garbled email. The email is the downloading user's own address, and Go's mail parser accepts }.

The same scripts also put CONTACT_EMAIL and the account name into the registration JSON heredoc (for example internal/iacfiles/templates/aws-wif-cli.sh.tmpl:165-170) without JSON escaping, so a " or \ in either value produces invalid JSON.

This cannot run commands: $, `, " and \ are still escaped for the shell. It is a correctness bug, not an injection.

Affected templates (all under internal/iacfiles/templates/, on main at 6b586cc):

• aws-cfn-deploy.sh.tmpl:56
• aws-cross-account-cfn-deploy.sh.tmpl:56
• aws-cross-account-cli.sh.tmpl:93
• aws-wif-cli.sh.tmpl:161
• azure-wif-cli.sh.tmpl:83
• azure-wif-deploy.sh.tmpl:121
• gcp-sa-impersonation-cli.sh.tmpl:100
• gcp-wif-cli.sh.tmpl:276

The Bicep deploy script was already fixed this way in #958/#991: the default moved onto its own line, and a json_escape helper is used for the payload (azure-wif-bicep-deploy.sh.tmpl:73-81). #991's closing note said the other 8 templates could get one follow-up; this is that follow-up. #1256 (which closed #153) left it out of scope on purpose.

Suggested fix

Port the #991 pattern to the 8 templates:

• assign the escaped default on its own line (CONTACT_EMAIL_DEFAULT="{{.ContactEmail}}", then CONTACT_EMAIL="${CUDLY_CONTACT_EMAIL:-$CONTACT_EMAIL_DEFAULT}"), so no template value sits inside ${...};
• build the registration JSON with json_escape (or jq -n --arg) for the email and account name;
• keep the server templates and scripts/generate-federation-iac.go in step.

Acceptance criteria

• For each of the 8 templates, rendering with a contact email that contains } and a name that contains " gives a script whose CONTACT_EMAIL equals the input exactly, and whose registration payload is valid JSON with the exact values. Reuse the Follow-ups from #963 review: '}' and JSON metacharacters in the Bicep/ARM contact email #991 test helper.
• The existing shell-escaping tests (no command execution through $, `, " or \) still pass.
• The generator's drift test still passes.

Refs #991, #958, #153, #1256.

Filed by IAmJSD's agent at IAmJSD's request (acting owner while the maintainers are away).