Harden Unix update source cache path

tests/release_scripts.rs

@@ -109,6 +109,27 @@ fn windows_installer_reuses_persistent_source_update_cache() {
     );
 }
 
+#[test]
+fn unix_installer_rejects_unsafe_source_update_cache_paths() {
+    let install = include_str!("../install.sh");
+    assert!(install.contains("normalize_update_cache_path()"));
+    assert!(install.contains("safe_update_cache_path()"));
+    assert!(install.contains("update_cache=\"$(safe_update_cache_path \"$update_cache\")\""));
+    for pattern in [
+        "\"\"|\"/\"|\"$home_norm\"|\"$home_cache_norm\"",
+        "\".\"|\"..\"|./*|../*|*/.|*/..|*/./*|*/../*",
+    ] {
+        assert!(
+            install.contains(pattern),
+            "Unix installer must reject unsafe update cache pattern {pattern}"
+        );
+    }
+    assert!(
+        install.contains("rm -rf \"$update_cache\""),
+        "source cache replacement remains the destructive operation guarded by safe_update_cache_path"
+    );
+}
+
 #[test]
 fn package_check_verifies_only_artifacts_it_builds() {
     let makefile = include_str!("../Makefile");