fix: stabilization pass — fail-closed auth, ai flag validation, lint/config/security hardening, regression tests

17-point code-level audit executed via Explorer->Architect->Builder->Tester->Reviewer;
Reviewer accepted (APPROVE_WITH_NOTES; 3 block-list items resolved):

- security: telegram sender-owner AND-gate + TELEGRAM_OWNER_ID, matrix
  MATRIX_ROOM_ID fail-closed, gpg --passphrase-fd 3 (no argv secret),
  /dev/tcp positional-arg form (checkport/smb-client/share-lib/NET_PROBE),
  eval deny-by-default + --no-command-execution carried by both chat bridges,
  tty-gated --trust; config/{telegram,matrix}.env reference templates
- ai: all ExecStart flags validated against installed llama.cpp
  (requested->error, default->omit+warn, CONFIG_REQUESTED_FLAGS); single-file
  hf download failure rc=1 + no .hf-meta; LLAMACPP_HOST coherent;
  POS_SUBCMDS + metadata gaps closed
- tooling: lint-conventions Bash-native rewrite (~24-30x faster, rules and
  output byte-identical, :num restored); pos system uninstall covers all 12
  libs + scale-tail + flags dir + systemd user units (|| true) + plugin
  markers; anchored .bash_completion/.bashrc removal replaces sed -i '/pos/d'
- config: canonical load_env_file in lib/config-ui.sh (CRLF strip, env-wins,
  XDG, LOADED_ENV_KEYS); 9 tools migrated; entertainment-lib collapsed to
  wrappers; docker-compose deliberately unmigrated (source semantics)
- tests: first committed regression suite — tests/run-tests.sh zero-dep
  runner + make test; 12 files / 179 checks / 0 skip / ~52s; hard skip
  contract; systemd-analyze verify on generated unit PASS

Verified: make gen idempotent; make check green; make lint 0 FAIL, 0 WARN;
make test green; bash -n clean; git diff --check clean. Audit deliverables +
agent reports + AGENT_TODO Done entry included.

lib/entertainment-lib.sh

@@ -21,36 +21,25 @@ source "$(dirname "${BASH_SOURCE[0]}")/../lib/user-timers-lib.sh" 2>/dev/null \
     || source "$(dirname "$0")/../lib/user-timers-lib.sh" 2>/dev/null \
     || source "$(dirname "$0")/user-timers-lib.sh"
 
+# Canonical config read/write + env loader (cfg_value/cfg_write/load_env_file).
+source "$(dirname "${BASH_SOURCE[0]}")/../lib/config-ui.sh" 2>/dev/null \
+    || source "$(dirname "${BASH_SOURCE[0]}")/config-ui.sh" 2>/dev/null \
+    || source "$(dirname "$0")/../lib/config-ui.sh" 2>/dev/null \
+    || source "$(dirname "$0")/config-ui.sh"
+
 # Per-plugin last-run state (rc + timestamp + first output line).
 LAST_RUN_DIR="${LAST_RUN_DIR:-$HOME/.local/share/linux_post_install/entertainment/last}"
 
-# ── Config file helpers (file is the source of truth, never sourced) ──
+# ── Config file helpers (thin wrappers over lib/config-ui.sh — the
+# canonical read/write API; same semantics, CRLF-safe, chmod 600) ──
 config_value() {
-    local k="$1" v
-    [ -f "$CONFIG_FILE" ] || return 0
-    v="$(sed -n "s|^${k}=||p" "$CONFIG_FILE" | tail -1)"
-    v="${v%\"}"; v="${v#\"}"; v="${v%\'}"; v="${v#\'}"
-    printf '%s' "$v"
+    local k="$1"
+    cfg_value "$CONFIG_FILE" "$k"
 }
 
 write_config_key() {
-    local key="$1" val="$2" tmp
-    val="${val//$'\r'/}"
-    val="${val%%$'\n'*}"
-    mkdir -p "$CONFIG_DIR"
-    if [ "$val" = "-" ]; then
-        [ -f "$CONFIG_FILE" ] || return 0
-        tmp="$(mktemp)"
-        grep -v "^${key}=" "$CONFIG_FILE" >"$tmp" || true
-        mv "$tmp" "$CONFIG_FILE"
-        chmod 600 "$CONFIG_FILE"
-        return 0
-    fi
-    tmp="$(mktemp)"
-    grep -v "^${key}=" "$CONFIG_FILE" 2>/dev/null >"$tmp" || true
-    printf '%s="%s"\n' "$key" "$val" >>"$tmp"
-    mv "$tmp" "$CONFIG_FILE"
-    chmod 600 "$CONFIG_FILE"
+    local key="$1" val="$2"
+    cfg_write "$CONFIG_FILE" "$key" "$val"
 }
 
 # ── Plugin lookup ──────────────────────────────────────────────────