Constrain dev_helper_version to Docker tag grammar ([A-Za-z0-9_][A-Za-z0-9_.-]{0,127}), re-validate before triggering the helper image build, and interpolate the image reference via escapeshellarg() when composing the docker build command.
