fix(10-03): quote the Dockerfile heredoc so comments cannot execute

`cat > "$WORK_DIR/Dockerfile.rootfs" <<DOCKERFILE` was unquoted, so the build
shell performed command substitution on the Dockerfile body. Any backtick in a
Dockerfile COMMENT was executed on the build host and its output spliced into
the generated file. Six comments did this. One of them ran
`systemctl start archipelago-fips.service` against the build machine on every
ISO build; the others were harmless only by accident of being command-not-found.

Fixes the class, not the six instances. The delimiter is now quoted, so the
body is emitted verbatim and a future backticked comment is inert. Verified the
boundary by line range first: the other backticked comments in this file
(:264, :809, :1188, :1289, :1506, :1605, :3597, :3651) are ordinary shell
comments outside any unquoted heredoc and were never at risk — they are
untouched.

The body needs exactly four build-time values and they are all package names
(LINUX_IMAGE_PKG, GRUB_EFI_PKG, GRUB_EFI_SIGNED_PKG, GRUB_PC_PKG), on four
consecutive lines. So quoting was practical: the heredoc is split into
DOCKERFILE_HEAD and DOCKERFILE_TAIL, both quoted, with a single explicit printf
interpolating those four names between them. Escapes that existed only because
the heredoc was unquoted are undone in the same pass: six trailing `\\` become
`\` (Docker line continuations) and four `\$` become `$` (RUN arguments reach
the shell verbatim — Docker does not substitute variables in RUN).

Verified by rendering the generated Dockerfile before and after with the same
inputs and diffing them normalised (continuations joined, whitespace
collapsed). Both are 190 normalised lines and the ONLY differences are the six
comments regaining their text — every instruction is byte-identical. Before:
"# the archipelago backend calls" / after: "# the archipelago backend calls
`systemctl start archipelago-fips.service`".

Test: case 7 asserts every heredoc writing Dockerfile.rootfs has a quoted
delimiter, and when one is not, reports which body lines would execute. The
assertion is on the delimiter, not on backticks — with quoting a backticked
comment is legal and six of them are back in the body on purpose, so flagging
backticks would flag a non-bug and fail on the very comments this restored.

This bug is invisible to `bash -n`; an instance of it introduced earlier in
this plan hung a syntactically-clean build for two minutes before being caught.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/first-boot-secrets/run-tests.sh

@@ -364,6 +364,56 @@ else
     echo "    generator heredoc spans lines $SS_START-$SS_END of $BUILDER"
 fi
 
+# ── Case 7: the Dockerfile heredoc delimiter must be quoted ──────────────
+# Lives in this harness rather than a sibling because it guards the same file
+# and the same failure mode the rest of these cases exist for: a build-side
+# defect that is invisible to `bash -n` and only shows up as damage on a build
+# host. Splitting it into its own runner would mean two commands to remember
+# and one of them getting skipped.
+#
+# The bug: `cat > ... <<DOCKERFILE` (unquoted) makes the build shell perform
+# command substitution on the Dockerfile body, so a backtick inside a COMMENT
+# is executed on the build host and its output spliced into the Dockerfile.
+# Six comments did exactly that, and one of them ran `systemctl start
+# archipelago-fips.service` against the build machine on every ISO build. The
+# comment text was silently deleted from the generated Dockerfile too.
+#
+# The assertion is on the DELIMITER, not on backticks. With a quoted delimiter
+# a backticked comment is inert and perfectly legal — six of them are back in
+# the body on purpose. Flagging backticks would be flagging a non-bug, and
+# would fail on the very comments this fix restored. Quoting is the fix;
+# vigilance about backticks is not.
+c7=""
+DF_HEREDOCS=$(grep -nE 'cat >>? "\$WORK_DIR/Dockerfile\.rootfs" <<' "$BUILDER" || true)
+if [ -z "$DF_HEREDOCS" ]; then
+    c7="$c7 no-dockerfile-heredoc-found"
+else
+    while IFS= read -r hd; do
+        [ -z "$hd" ] && continue
+        ln=${hd%%:*}
+        delim=$(printf '%s' "$hd" | sed -E 's/.*<<-?[[:space:]]*//')
+        case "$delim" in
+            \'*\'|\"*\")
+                : ;;   # quoted — the body is emitted verbatim, nothing executes
+            *)
+                c7="$c7 UNQUOTED-DELIMITER-at-line-$ln"
+                # Only meaningful when unquoted: report what would actually run.
+                bare=$(printf '%s' "$delim" | tr -d "\"'")
+                endln=$(awk -v s="$ln" -v d="$bare" 'NR>s && $0==d { print NR; exit }' "$BUILDER")
+                if [ -n "$endln" ]; then
+                    subs=$(awk -v s="$ln" -v e="$endln" 'NR>s && NR<e && (/`/ || /\$\(/) { print NR }' "$BUILDER" | tr '\n' ',')
+                    [ -n "$subs" ] && c7="$c7 would-execute-at-lines:${subs%,}"
+                fi
+                ;;
+        esac
+    done <<< "$DF_HEREDOCS"
+fi
+if [ -z "$c7" ]; then
+    ok "Dockerfile heredoc delimiters are quoted — a backticked comment cannot execute"
+else
+    bad "Dockerfile heredoc quoting ->$c7"
+fi
+
 # ── Summary ───────────────────────────────────────────────────────────────
 echo
 echo "──────── first-boot-secrets summary ────────"