Fix command injection in change_permissions_to_root

Replace ssh_client.exec_command(f'chmod 600 {filepath}') with
sftp_client.chmod(filepath, 0o600). The shell-interpolated filepath
allowed injection of arbitrary commands via crafted filenames.

Closes #85

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: szachovy

CHANGELOG.md

@@ -16,6 +16,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * CI workflow to build and push service images to GitHub Container Registry on master merge. (#97)
 * Pull-first with local build fallback for container images during deployment. (#97)
 
+### Fixed
+
+* Command injection in change_permissions_to_root via SFTP chmod instead of shell exec. (#85)
+
 ### Changed
 
 * Completed [ARCHITECTURE.md](./docs/ARCHITECTURE.md) (#93)

src/remote.py

@@ -160,4 +160,4 @@ def upload_file(self, content: str | bytes, remote_file_path: str) -> None:
         self.sftp_client.putfo(io.BytesIO(content), remote_file_path)
 
     def change_permissions_to_root(self, filepath: str) -> None:
-        self.ssh_client.exec_command(f"chmod 600 {filepath}")
+        self.sftp_client.chmod(filepath, 0o600)