ci: move template expressions out of run: shells (signals#47)

autoresearch.yml expanded the rq_id, fixture, iters and model
workflow_dispatch inputs (and the rq_id step output derived from them)
directly into run: shells. They now arrive via env:; loop.py arguments
are built as a bash array so a value with spaces stays one argument.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/autoresearch.yml

@@ -31,13 +31,21 @@ jobs:
 
       - name: Resolve run ID
         id: vars
+        # signals#47: inputs and outputs derived from them reach the shell via
+        # env, never via ${{ }} expansion inside run: (a `"` or `$(...)` in an
+        # input would otherwise run as code).
+        env:
+          IN_RQ_ID: ${{ inputs.rq_id }}
+          IN_FIXTURE: ${{ inputs.fixture }}
         run: |
-          RQ_ID="${{ inputs.rq_id }}"
-          [ -z "$RQ_ID" ] && RQ_ID="${{ inputs.fixture }}"
+          RQ_ID="$IN_RQ_ID"
+          [ -z "$RQ_ID" ] && RQ_ID="$IN_FIXTURE"
           echo "rq_id=$RQ_ID" >> "$GITHUB_OUTPUT"
 
       - name: Clean stale run dir
-        run: rm -rf "runs/${{ steps.vars.outputs.rq_id }}"
+        env:
+          RQ_ID: ${{ steps.vars.outputs.rq_id }}
+        run: rm -rf "runs/$RQ_ID"
 
       - name: Set up Python venv
         run: |
@@ -48,20 +56,26 @@ jobs:
           .venv/bin/pip install -q -r requirements.txt
 
       - name: Scaffold run dir
+        env:
+          IN_FIXTURE: ${{ inputs.fixture }}
+          RQ_ID: ${{ steps.vars.outputs.rq_id }}
         run: |
           .venv/bin/python scripts/autoresearch_start.py \
-            "fixtures/${{ inputs.fixture }}.json" \
-            "${{ steps.vars.outputs.rq_id }}"
+            "fixtures/$IN_FIXTURE.json" \
+            "$RQ_ID"
 
       - name: Run autoresearch loop
         env:
           LITELLM_KEY: ${{ secrets.LITELLM_KEY }}
           LITELLM_BASE: ${{ secrets.LITELLM_BASE }}
           NTFY_URL: ${{ secrets.NTFY_URL }}
+          RQ_ID: ${{ steps.vars.outputs.rq_id }}
+          IN_ITERS: ${{ inputs.iters }}
+          IN_MODEL: ${{ inputs.model }}
         run: |
-          ARGS="--run-dir runs/${{ steps.vars.outputs.rq_id }} --iters ${{ inputs.iters }}"
-          [ -n "${{ inputs.model }}" ] && ARGS="$ARGS --model ${{ inputs.model }}"
-          .venv/bin/python loop.py $ARGS
+          ARGS=(--run-dir "runs/$RQ_ID" --iters "$IN_ITERS")
+          [ -n "$IN_MODEL" ] && ARGS+=(--model "$IN_MODEL")
+          .venv/bin/python loop.py "${ARGS[@]}"
 
       - name: Upload run artifacts
         if: always()