fix(ci): an apostrophe in a comment killed six runs

Runs 491 through 496 failed on one character.

The Rust step is a `docker run … sh -c '…'`. A comment inside that
single-quoted block read `cm-api's vm_tool_gate`, and the apostrophe closed
the quote. Bash died with "unexpected EOF while looking for matching quote"
BEFORE running anything — which is why no log ever appeared, why the
breadcrumb showed the step entered and produced nothing, and why three
separate theories were floated to explain an empty failure.

I introduced it in the commit that installed nodejs, so the fix for run 490
broke every run after it.

Run 490 itself was the stomping: it overlapped run 491, which began by
removing the shared `cm-ci-pg` container out from under it. That is fixed
too, and was a real defect — it was simply not the cause of 491+.

`bash -n` answers this in milliseconds and nothing was running it: a
workflow is not compiled, not linted, and its only feedback is a red build
with a log this deployment cannot read. `tests/workflow_shell_syntax.rs`
now extracts every `run:` block and syntax-checks it, so the failure shows
up before the push rather than six runs later. Gitea's `${{ … }}` is
replaced with a placeholder first — the point is to check OUR quoting, not
to evaluate their templating. Negative control: restoring the apostrophe
fails the test with the file and line.

The block also carries a standing NO APOSTROPHES warning, because the next
person to write a comment there will not be thinking about quoting.

Co-Authored-By: Claude Opus 5 <[email protected]>

.gitea/workflows/deploy.yml

@@ -133,8 +133,14 @@ jobs:
             -v /tmp/ci-logs:/cilog \
             rust:1.96-slim \
             sh -c 'set -e
+              # NO APOSTROPHES BELOW THIS LINE. Everything here is inside a
+              # single-quoted sh -c, so one apostrophe in a COMMENT closes the
+              # quote and the step dies with "unexpected EOF while looking for
+              # matching quote" — before running anything, which is why no log
+              # ever appeared. Runs 491 through 496 failed on the word
+              # "cm-api" followed by an apostrophe-s.
               apt-get update -qq
-              # nodejs: cm-api's vm_tool_gate shell tests EXECUTE the generated
+              # nodejs: the vm_tool_gate shell tests in cm-api EXECUTE the generated
               # PreToolUse hook, which parses its JSON payload with node (no jq
               # in the runtime image; node is guaranteed there because Claude
               # Code is a node program). Without it the hook takes its
@@ -143,10 +149,10 @@ jobs:
               apt-get install -y -qq pkg-config libssl-dev cmake git nodejs >/dev/null
               git config --global url."https://oauth2:[email protected]/".insteadOf "https://git.redclaw.dev/"
               # Full output to a host-mounted file, then the tail, then exit
-              # with CARGO's status. Piping cargo into `tail` would report
-              # tail's exit code — a green job over a red suite. The log
+              # with the cargo status. Piping cargo into `tail` would report
+              # the exit code of tail — a green job over a red suite. The log
               # survives the container so a failure is diagnosable at all:
-              # Gitea's actions-log API returns 403 for our token, and three
+              # the Gitea actions-log API returns 403 for our token, and three
               # failed runs were debugged blind before this existed.
               set +e
               cargo test --workspace > /cilog/rust.log 2>&1