fix: tighten up shell arg quoting in GitHub workflows (#14864)

Inspired by the work done over in
https://github.com/openai/codex-action/pull/74, this tightens up our use
of GitHub expressions as shell/environment variables.