- Add set -euo pipefail to install and update scripts for fail-fast behavior
- Escape sed replacement strings to prevent injection via special characters
- Add || true guards for commands expected to fail (tr pipe, read prompts)
- Validate target_tag in update-watcher to prevent unsafe characters in sed
- Properly quote variable assignments to satisfy strict mode
https://claude.ai/code/session_01JFvpTYgm8GiE4vJ4cJKsFx