fix(ci): version_check via env var — unblocks acl2/hol4 cron cells (#75) (#165)

## Summary

- Both `Smoke-check` and `Stub-sentinel detection (#75)` steps in
`.github/workflows/container-ci.yml` template `${{ matrix.version_check
}}` directly inside outer single quotes (`-c '${{ matrix.version_check
}}'`).
- For acl2 and hol4, the matrix values contain literal single quotes
(`echo '(acl2::quit)' | acl2 …` / `echo '(* quit *);' | hol …`), so the
embedded `'` closes the outer string and bash dies with `syntax error
near unexpected token '('` at runner-script line 2. `|| true` can't
rescue it — the outer parse fails before any inner command runs.
- Cron evidence: 6 consecutive `Container Build Verification` schedule
runs (2026-05-03 → 2026-05-31) show acl2 + hol4 as failure; all other 6
cells pass. Defect introduced 2026-04-27 (a87fae1), inherited verbatim
by #157 on 2026-05-31.
- Fix: pass via `env: VERSION_CHECK:` and dereference with `-c
"$VERSION_CHECK"`. Same shape for both steps. YAML still parses
(`python3 -c "import yaml; yaml.safe_load(open(...))"` OK). Inline
comment notes the trap so the next contributor can avoid re-introducing
it.

After this merges, the next scheduled run will reveal whether acl2/hol4
are running real binaries or graceful stubs — exactly the truth #157's
stub-sentinel was meant to surface. If a stub is hiding, #75 stays open
until the upstream pin is bumped; if the binaries are real, #75 closes.

## Test plan

- [x] YAML safe-load passes locally
- [ ] Trigger on schedule (next cron) — verify 8/8 cells reach the
sentinel grep step
- [ ] Confirm acl2 + hol4 either pass or fire the stub-sentinel error
(no longer crash on shell-syntax)

Refs #75, refs #157.

Author: hyperpolymath

.github/workflows/container-ci.yml

@@ -174,10 +174,18 @@ jobs:
         run: |
           podman run --rm "${{ matrix.image }}" --version
 
+      # version_check is passed via env to avoid the YAML→outer-shell→inner-sh
+      # single-quote nesting trap: for acl2 (`echo '(acl2::quit)' | acl2 …`) and
+      # hol4 (`echo '(* quit *);' | hol …`), the inline `-c '${{ matrix.version_check }}'`
+      # form lets the embedded `'` close the outer string and the bash parser
+      # fails with "syntax error near unexpected token `('". Confirmed root-cause
+      # of the persistent acl2/hol4 cron red since 2026-04-27 (a87fae12).
       - name: Smoke-check ${{ matrix.prover }} binary
+        env:
+          VERSION_CHECK: ${{ matrix.version_check }}
         run: |
           podman run --rm --entrypoint /bin/sh "${{ matrix.image }}" \
-            -c '${{ matrix.version_check }}'
+            -c "$VERSION_CHECK"
 
       # #75: the per-prover version_check above uses `|| true` for several
       # backends because tools like metamath / hol4 / acl2 exit non-zero on
@@ -188,10 +196,12 @@ jobs:
       # output verbatim, and fails LOUDLY on any stub sentinel — turning the
       # silent degradation into a visible weekly red.
       - name: Stub-sentinel detection (#75)
+        env:
+          VERSION_CHECK: ${{ matrix.version_check }}
         run: |
           set +e
           OUTPUT=$(podman run --rm --entrypoint /bin/sh "${{ matrix.image }}" \
-            -c '${{ matrix.version_check }}' 2>&1)
+            -c "$VERSION_CHECK" 2>&1)
           echo "--- version_check output ---"
           echo "$OUTPUT"
           echo "--- end ---"