cluster0: Gmail mail relay (msmtp + PHP SMTP), lab cron

Mirror alpine-be msmtp for CLI; compose uses Gmail SMTP for php-fpm.
Safe secrets.lab.env parser; deploy-mailrelay, install-lab-cron, verify-mail-lab.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/scripts/lib/common.sh

@@ -189,10 +189,34 @@ read_cred() {
 load_secrets_lab() {
   _file="${CAST_CLUSTER_ROOT}/secrets.lab.env"
   [ -f "$_file" ] || return 0
-  set -a
-  # shellcheck source=/dev/null
-  . "$_file"
-  set +a
+  # Export only simple KEY=value lines (no shell metacharacters in values via source).
+  while IFS= read -r _line || [ -n "$_line" ]; do
+    case "$_line" in
+      ''|\#*) continue ;;
+      *=*)
+        _k="${_line%%=*}"
+        _v="${_line#*=}"
+        case "$_k" in
+          MAIL_*|MSMTP_*|SMTP_*|AUTH_*|GITEA_*|WG_*|RSSH_*)
+            export "$_k=$_v"
+            ;;
+        esac
+        ;;
+    esac
+  done < "$_file"
+}
+
+read_secret() {
+  _key="$1"
+  _file="${CAST_CLUSTER_ROOT}/secrets.lab.env"
+  [ -f "$_file" ] || return 1
+  awk -v k="$_key" '
+    $0 ~ "^" k "=" {
+      sub("^" k "=", "")
+      print
+      exit
+    }
+  ' "$_file"
 }
 
 ssh_node() {