principle-never-interpolatelisted

# Never Interpolate Untrusted text never travels through a shell command's text. Prose reaches a command through a file, stdin, or the environment; the only strings that enter command text are scalars that passed a byte-exact allowlist in the same invocation that uses them. **Why:** Double quotes stop word-splitting and globbing; they do not stop `$(...)` or backticks — a body spliced into a quoted argument executes with your credentials, and anyone who can file an issue can invite it. Heredocs are no safer: a body line equal to the delimiter ends the heredoc early and the rest runs as shell. **Pattern:** - Splicing is the sin: unvalidated prose never enters command text. Prose goes by file (`--body-file`, `-F body=@-`) or stdin; the sanctioned argv forms are allowlisted scalars, guarded `"${VAR:?}"` expansions, and values delivered through the environment into a declared command line that runs verbatim — never edited or re-quoted to receive them. - Scalars (branch names, IDs) pass a character allowlist first, with `LC_ALL=C` so the class is byte-exact. Refuse on failure — never normalize a name to make it pass. Syntax checkers are not shell controls; only the allowlist makes a name safe to place in a command. - Terminate options with `--` where a value could be read as an option. A value whose position already fixes its role needs no terminator when its allowlist excludes a leading `-`; otherwise it gets one. - Paths get containment checks before destruc