Validate library install inputs before shell execution #162

Context

Language handlers build package installation commands by interpolating libraries values into shell command strings, for example pip/npm/go/gem/apt/R commands. MCP exposes libraries as user-provided input.

Why this matters

Even inside containers, package install input should not be treated as trusted shell text. This is especially important for MCP and user-submitted code paths.

Acceptance criteria

• Add language-specific validation for package/library identifiers, or move execution to argument-vector APIs where possible.
• Reject unsafe values with a clear exception before command execution.
• Cover Python, JavaScript, Go, Ruby, R, and C++/apt flows.
• Add tests for valid package names and obvious shell metacharacter injection attempts.
• Document accepted package spec formats and limitations.