fix: address 5 critical and major PR review issues

- Remove set -e from validate-marketplace.sh to prevent early exit on
  check failures, allowing the summary to always be displayed (PRRT_kwDOO6Hdxs5uvKrc)
- Fix marketplace.json source path to point to skills/unraid instead of
  ./ for correct plugin directory resolution (PRRT_kwDOO6Hdxs5uvKrg)
- Fix misleading trap registration comment in unraid-api-crawl.md and
  add auth note to Apollo Studio URL (PRRT_kwDOO6Hdxs5uvO2t)
- Extract duplicated cleanup-with-error-handling in main.py into
  _run_shutdown_cleanup() helper (PRRT_kwDOO6Hdxs5uvO3A)
- Add input validation to read-logs.sh to prevent GraphQL injection
  via LOG_NAME and LINES parameters (PRRT_kwDOO6Hdxs5uvKrj)

docs/research/unraid-api-crawl.md

@@ -81,7 +81,7 @@ The Unraid API provides a GraphQL interface that allows you to interact with you
 #### Enabling the GraphQL Sandbox
 
 **Live Documentation:**
-- View the complete API schema and documentation at [Apollo GraphQL Studio](https://studio.apollographql.com/graph/Unraid-API/variant/current/home)
+- View the complete API schema and documentation at [Apollo GraphQL Studio](https://studio.apollographql.com/graph/Unraid-API/variant/current/home) *(requires authentication; may not be publicly accessible)*
 
 **WebGUI method (recommended):**
 1. Navigate to **Settings > Management Access > Developer Options**
@@ -468,7 +468,7 @@ unraid-api apikey --delete --name "workflow key" --json
 #!/bin/bash
 set -e
 
-# Set up cleanup trap early so it fires even if key creation fails
+# Define cleanup function (deletes the temporary key)
 cleanup() { echo "Cleaning up..."; unraid-api apikey --delete --name "temp deployment key" 2>/dev/null || true; }
 
 # 1. Create temporary API key
@@ -479,7 +479,7 @@ KEY_DATA=$(unraid-api apikey --create \
   --description "Temporary key for deployment $(date)" \
   --json)
 
-# Register trap after key creation succeeds
+# Register trap only after key creation succeeds (nothing to clean up if creation failed)
 trap cleanup EXIT
 
 # 2. Extract the API key