fix: validate class name input and check file write in Make commands

Add path traversal protection via PHP class name regex validation to all
four Make* commands, check file_put_contents() return value for write
failures, and remove the unnecessary \$defer = false property from
CartServiceProvider.

src/Commands/MakeTaxCommand.php

@@ -15,11 +15,19 @@ class MakeTaxCommand extends Command
     public function handle(): int
     {
         $name = $this->argument('name');
+
+        if (! preg_match('/^[a-zA-Z_][a-zA-Z0-9_]*$/', $name)) {
+            $this->error("Invalid class name: [{$name}]. Must be a valid PHP class name.");
+
+            return self::FAILURE;
+        }
+
         $directory = app_path('Cart/Tax');
         $path = "{$directory}/{$name}.php";
 
         if (file_exists($path)) {
             $this->error("Tax rule already exists: app/Cart/Tax/{$name}.php");
+
             return self::FAILURE;
         }
 
@@ -27,7 +35,12 @@ public function handle(): int
             mkdir($directory, 0755, true);
         }
 
-        file_put_contents($path, static::stub($name));
+        if (file_put_contents($path, static::stub($name)) === false) {
+            $this->error("Failed to write file: {$path}");
+
+            return self::FAILURE;
+        }
+
         $this->info("Tax rule created: app/Cart/Tax/{$name}.php");
 
         return self::SUCCESS;