Build compromise via unpinned remote scripts

Code execution in mce-operator-bundle in Red Hat multicluster engine for Kubernetes allows attackers to compromise builds via a mutable remote script source. The bundle-generation workflow uses tools/run-script-from-tools-repo to clone stolostron/release and run business logic from its master branch without commit pinning, signature checks, or other integrity validation. Exploitation requires write access to that upstream repository or compromise of the source path; reachable builds can execute injected code in the build context and taint shipped bundle artifacts.