Cover all six pathological character classes (single-quote,
double-quote, space, semicolon, newline, backtick) in both
upstream URL and name positions. Each case validates rendered
output via `sh -n` and asserts the original value is preserved
verbatim after shlex.quote encoding. Also add `sh -n` smoke
tests for the static pre-receive and access-hook scripts.
didericis-claude