fix(compile): silence shellcheck SC2046 on $(AW_AZ_MOUNTS) macro

The new `$(AW_AZ_MOUNTS)` line in the AWF invocation chain is an
ADO macro substituted before bash sees it, not a bash command
substitution. shellcheck cannot distinguish the two and flagged
every compiled fixture with SC2046 ("Quote this to prevent word
splitting"), turning Build & Test red.

Word splitting of the expanded value into separate `--mount` tokens
is intentional and required (the pipeline variable expands to
`--mount /opt/az:/opt/az:ro --mount /usr/bin/az:/usr/bin/az:ro` or
to the empty string). Quoting would produce a single malformed
token. Disable SC2046 with an inline directive on the `sudo -E`
line in all four base templates (base, 1es-base, job-base,
stage-base) so the directive applies to the multi-line awf
invocation as a unit.

Regenerated tests/safe-outputs/azure-cli.lock.yml; verified
bash_lint_tests passes locally with shellcheck 0.11.0.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: jamesadevine

src/data/1es-base.yml

@@ -344,6 +344,7 @@ extends:
                     # sed -u = unbuffered (line-by-line) so output appears immediately.
                     # tee writes to both stdout (ADO pipeline log) and the artifact file.
                     # pipefail (set above) ensures AWF's exit code propagates through the pipe.
+                    # shellcheck disable=SC2046 # $(AW_AZ_MOUNTS) is an ADO macro substituted before bash sees it, not bash command substitution; word-splitting the expanded value into separate --mount tokens is intentional
                     sudo -E "$(Pipeline.Workspace)/awf/awf" \
                       --allow-domains "{{ allowed_domains }}" \
                       --skip-pull \

src/data/base.yml

@@ -316,6 +316,7 @@ jobs:
           # sed -u = unbuffered (line-by-line) so output appears immediately.
           # tee writes to both stdout (ADO pipeline log) and the artifact file.
           # pipefail (set above) ensures AWF's exit code propagates through the pipe.
+          # shellcheck disable=SC2046 # $(AW_AZ_MOUNTS) is an ADO macro substituted before bash sees it, not bash command substitution; word-splitting the expanded value into separate --mount tokens is intentional
           sudo -E "$(Pipeline.Workspace)/awf/awf" \
             --allow-domains "{{ allowed_domains }}" \
             --skip-pull \

src/data/job-base.yml

@@ -303,6 +303,7 @@ jobs:
           # sed -u = unbuffered (line-by-line) so output appears immediately.
           # tee writes to both stdout (ADO pipeline log) and the artifact file.
           # pipefail (set above) ensures AWF's exit code propagates through the pipe.
+          # shellcheck disable=SC2046 # $(AW_AZ_MOUNTS) is an ADO macro substituted before bash sees it, not bash command substitution; word-splitting the expanded value into separate --mount tokens is intentional
           sudo -E "$(Pipeline.Workspace)/awf/awf" \
             --allow-domains "{{ allowed_domains }}" \
             --skip-pull \

src/data/stage-base.yml

@@ -317,6 +317,7 @@ stages:
             # sed -u = unbuffered (line-by-line) so output appears immediately.
             # tee writes to both stdout (ADO pipeline log) and the artifact file.
             # pipefail (set above) ensures AWF's exit code propagates through the pipe.
+            # shellcheck disable=SC2046 # $(AW_AZ_MOUNTS) is an ADO macro substituted before bash sees it, not bash command substitution; word-splitting the expanded value into separate --mount tokens is intentional
             sudo -E "$(Pipeline.Workspace)/awf/awf" \
               --allow-domains "{{ allowed_domains }}" \
               --skip-pull \