Problem

src-cli rejects commas in top-level steps.files target paths because a comma breaks out of Docker --mount syntax and lets an attacker inject arbitrary source=/target= pairs (e.g. mounting /var/run/docker.sock). That same validation was missing for changesetHooks.*.steps[].files, so a malicious v3 batch spec could smuggle a dangerous files target path through a hook and reach the executor-side Docker mount sink.

The executor (src batch exec) makes this worse: it loads already-parsed Step structs from JSON and never re-runs ParseBatchSpec/validateHooks, so parse-time validation alone is a coordinator-only guard.

Solution

• Add the missing comma check for files target paths in validateHooks (covers both onCIFailure and onMergeConflict).
• Add defense-in-depth validation at the executor sink in createFilesToMount, so the check holds regardless of how a step reaches the executor.

Verification Evidence

$ go test ./internal/batches/service/ -run ParseBatchSpec -v
--- PASS: TestService_ParseBatchSpec/hook_files_target_path_with_comma

$ go test ./internal/batches/executor/ -run CreateFilesToMount -v
--- PASS: TestCreateFilesToMount_RejectsCommaInTargetPath

$ go test ./internal/batches/...
ok  	github.com/sourcegraph/src-cli/internal/batches/executor	2.402s
ok  	github.com/sourcegraph/src-cli/internal/batches/service	0.626s
(all batch packages pass)