fix(ci): version_check via env var — unblocks acl2/hol4 cron cells (#75)

Both Smoke-check and Stub-sentinel-detection steps in container-ci.yml
template `matrix.version_check` directly inside outer single quotes:

    -c '${{ matrix.version_check }}'

For acl2 (`echo '(acl2::quit)' | acl2 …`) and hol4 (`echo '(* quit *);'
| hol …`), the embedded `'` closes the outer string and bash fails
parsing with `syntax error near unexpected token '('`. The cell exits 2
before the inner shell ever runs — `|| true` cannot rescue it because
the outer parse fails first.

Confirmed root cause of the persistent acl2 + hol4 reds in the weekly
Container Build Verification cron since a87fae1 (2026-04-27); same
defect was inherited by #157 when it added the Stub-sentinel step on
2026-05-31. Six consecutive cron runs show the same two cells red.

Fix: pass `version_check` through a job-step `env:` block as
`VERSION_CHECK` and dereference with `-c "$VERSION_CHECK"`. The outer
shell now sees a clean double-quoted variable expansion; the inner
`/bin/sh -c` receives the literal command with its single quotes intact.
The same shape applied to both steps so the fix is uniform.

Side benefit: defends both steps against any future `version_check`
matrix entry containing single quotes, parens, or other shell
metacharacters. Caveat documented inline: matrix values must not embed
literal `$`-prefixed shell variables that would expand at the runner
level.

Closes the longest-standing wave3 container-cron red and lets #157's
stub-sentinel detection function across all 8 matrix cells instead of 6.
Refs #75, refs #157.

Author: hyperpolymath

.github/workflows/container-ci.yml

@@ -174,10 +174,18 @@ jobs:
         run: |
           podman run --rm "${{ matrix.image }}" --version
 
+      # version_check is passed via env to avoid the YAML→outer-shell→inner-sh
+      # single-quote nesting trap: for acl2 (`echo '(acl2::quit)' | acl2 …`) and
+      # hol4 (`echo '(* quit *);' | hol …`), the inline `-c '${{ matrix.version_check }}'`
+      # form lets the embedded `'` close the outer string and the bash parser
+      # fails with "syntax error near unexpected token `('". Confirmed root-cause
+      # of the persistent acl2/hol4 cron red since 2026-04-27 (a87fae12).
       - name: Smoke-check ${{ matrix.prover }} binary
+        env:
+          VERSION_CHECK: ${{ matrix.version_check }}
         run: |
           podman run --rm --entrypoint /bin/sh "${{ matrix.image }}" \
-            -c '${{ matrix.version_check }}'
+            -c "$VERSION_CHECK"
 
       # #75: the per-prover version_check above uses `|| true` for several
       # backends because tools like metamath / hol4 / acl2 exit non-zero on
@@ -188,10 +196,12 @@ jobs:
       # output verbatim, and fails LOUDLY on any stub sentinel — turning the
       # silent degradation into a visible weekly red.
       - name: Stub-sentinel detection (#75)
+        env:
+          VERSION_CHECK: ${{ matrix.version_check }}
         run: |
           set +e
           OUTPUT=$(podman run --rm --entrypoint /bin/sh "${{ matrix.image }}" \
-            -c '${{ matrix.version_check }}' 2>&1)
+            -c "$VERSION_CHECK" 2>&1)
           echo "--- version_check output ---"
           echo "$OUTPUT"
           echo "--- end ---"