fix(MESHCENT-003): CU-86akbhhdk meshinstall-initd.sh PID file removal uses malformed quoting, likely deletes wrong file (missing path traversal protection also unclear)

[flamingo]

Closes findings from rule MESHCENT-003 — meshinstall-initd.sh PID file removal uses malformed quoting, likely deletes wrong file (missing path traversal protection also unclear).

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟢 95 high	meshinstall-initd.sh PID file removal uses malformed quoting, likely deletes wrong file (missing path traversal protection also unclear)	agents/meshinstall-initd.sh:43

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: a271a374-6235-40d2-8fdd-b6d4de951f4b

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akbhhdk MeshCentral webauthn and plugin JS fixes (15 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

1 finding(s) fixed in this draft — 1 explained inline on the diff.

[flamingo]

🦩 🔴 meshinstall-initd.sh PID file removal uses malformed quoting, likely deletes wrong file (missing path traversal protection also unclear)

Changed rm -f $"PIDFILE" to rm -f "$PIDFILE" in the stop() function, fixing the malformed quoting so the actual PID file path stored in the $PIDFILE variable is removed instead of the literal string "PIDFILE".

🤖 Prompt for AI agents

In agents/meshinstall-initd.sh around line 43, review and complete this code-review fix: meshinstall-initd.sh PID file removal uses malformed quoting, likely deletes wrong file (missing path traversal protection also unclear).
What the draft fix changed: Changed `rm -f $"PIDFILE"` to `rm -f "$PIDFILE"` in the `stop()` function, fixing the malformed quoting so the actual PID file path stored in the `$PIDFILE` variable is removed instead of the literal string "PIDFILE".
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 95 high — react 👍/👎 to teach the reviewer