Adds two static checks to -analyze: a literal apostrophe inside a
-c bash -euxc '...' single-quoted shell block (closes the quote early,
dropping the rest of the script to the outer shell - this broke
oleks/mempalace pipeline 218 via a comment containing "Woodpecker's"),
and an unescaped ${VAR} in step commands (Woodpecker substitutes braced
${VAR} at parse time before the shell runs, so shell-owned vars need
$${VAR} - see oleks/mempalace commit 33b880d). Woodpecker's own ${CI_*}
builtins and a pipeline's own matrix: axis names are excluded as
legitimate unescaped uses (the matrix exclusion was added after a fleet
run initially false-positived on oleks/ii-researcher/csi-s3/
common-chronicle's ${TARGET_ARCH} matrix axis).
Verified against ~/projects: 0 stray apostrophes fleet-wide, 8 genuine
unescaped-var findings (oleks/deals-site, oleks/element-web-patched,
oleks/terminal-agent); oleks/oracle-adb-backend and the fixed
oleks/mempalace test.yaml are clean, confirming no false positives on
the two repos known-good post-fix.
Oleks