K-114: address cross-review findings

- CTID prompt re-prompts on invalid interactive input (was: abort)
- env-provided NAMESERVER is validated when non-empty ('' stays inherit)
- prompt_validated handles EOF (no infinite loop, clean abort under -e)
- 10# base forcing in vlan/cidr/ipv4 arithmetic (leading zeros are not
  octal errors); is_clean_ascii rejects embedded newline/tab explicitly
  (command substitution strips trailing newlines); is_ipv4_list checks
  the whole string before word splitting
- nameref guard against reserved variable names in prompt_validated/
  require_valid; source-check pattern documented as the repo contract
- 8 new test cases (41 total)

tests/test_validation.sh

@@ -108,6 +108,39 @@ else
   nok "alle ct/*.sh sourcen build.func"
 fi
 
+# ── Review-Findings K-114: Oktal, Newline, EOF, Nameref-Guard ────────────────
+assert_true  "is_vlan_tag akzeptiert '08' (kein Oktal-Fehler)"  is_vlan_tag "08"
+assert_true  "is_cidr akzeptiert /08 (kein Oktal-Fehler)"       is_cidr "10.0.0.1/08"
+assert_false "is_clean_ascii lehnt eingebettetes Newline ab"    is_clean_ascii $'1.1.1.1\n8.8.8.8'
+assert_false "is_ipv4_list lehnt Newline-Liste ab"              is_ipv4_list $'1.1.1.1\n8.8.8.8'
+
+# EOF statt Eingabe: prompt_validated darf nicht endlos loopen.
+( printf '' | { V=""; prompt_validated V "Wert: " is_uint; } ) >/dev/null 2>&1
+rc=$?
+[[ "$rc" -ne 0 ]] && ok "prompt_validated bricht bei EOF ab (rc=$rc)" \
+  || nok "prompt_validated bricht bei EOF ab"
+
+# Reservierte Namen → Guard statt zirkulärem nameref.
+( _pv_ref=""; prompt_validated _pv_ref "x: " is_uint ) >/dev/null 2>&1
+[[ $? -eq 2 ]] && ok "prompt_validated weist reservierte Variablennamen ab" \
+  || nok "prompt_validated weist reservierte Variablennamen ab"
+
+# CTID-Re-Prompt: ungültig → erneut fragen, leer wäre auto (hier: gültige Zahl).
+ctid_out="$(
+  printf 'abc\n123\n' | env -u CTID bash -c "
+    source '$REPO_ROOT/lib/build.func'
+    CTID=''
+    while true; do
+      read -rp 'Container ID [auto]: ' CTID || exit 1
+      CTID=\"\$(sanitize_input \"\$CTID\")\"
+      [[ -z \"\$CTID\" ]] && exit 1
+      is_uint \"\$CTID\" && break
+    done
+    printf '%s' \"\$CTID\""
+)"
+[[ "$ctid_out" == "123" ]] && ok "CTID-Loop re-promptet bei 'abc' und nimmt '123'" \
+  || nok "CTID-Loop re-promptet (got: '$ctid_out')"
+
 # ── Dry-Run: prompt_lxc_config komplett aus env, ohne PVE/TTY ────────────────
 smoke_out="$(
   env CTID=999 CT_HOSTNAME=smoke DISK_SIZE=8 CORES=2 RAM=1024 BRIDGE=vmbr0 \