Fix path validator always failing on bash 3.2

In bash, strings cannot contain NUL bytes, so `$'\0'` expands to the empty
string. The pattern `*$'\0'*` collapsed to `**`, which matches every
non-empty value, so `validate_path` aborted on every real path with
"Path contains control chars".

- Drop the NUL check entirely (impossible to violate by construction).
- Use a single case statement for the newline and traversal checks; more
  predictable than chained [[ ... && ... ]] glob comparisons on bash 3.2.

Verified: paths with spaces, dots in basenames (~/.config, ~/.local), and
the iCloud bundle directory all pass; empty paths, "..", and embedded
newlines still reject.

Repro before fix:
  $ ./install.sh
  [ERR] Path contains control chars

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/common.sh

@@ -52,13 +52,14 @@ ssr::confirm() {
     [[ "${reply,,}" == "y" ]]
 }
 
-# Validate a path is safe (no traversal, no shell metas). Used before any FS op.
+# Validate a path is safe (no newlines, no `..` traversal). Used before any FS op.
+# Note: bash strings cannot hold NUL bytes, so no separate NUL check needed.
 ssr::validate_path() {
     local p="$1"
     [[ -n "$p" ]] || ssr::die "Empty path"
-    [[ "$p" != *$'\n'* && "$p" != *$'\0'* ]] || ssr::die "Path contains control chars"
     case "$p" in
-        *..*) ssr::die "Path traversal rejected: $p" ;;
+        *$'\n'*) ssr::die "Path contains newline: $p" ;;
+        *..*)    ssr::die "Path traversal rejected: $p" ;;
     esac
 }