fix(ci): pass commits JSON via env block to avoid bash quoting break

The detect-changes step's push path used `echo '${{ toJSON(github.event.commits) }}'`
which broke on every main push because every main commit is a Gitea merge commit
whose message contains single quotes (e.g. "Merge pull request 'fix: ...' from branch
into main"). The embedded `'` ended the single-quoted bash string mid-JSON, and a
subsequent `(` (e.g. in "#523)") was parsed as a subshell → "syntax error near
unexpected token `('". This caused detect-changes to exit 2 → main-red.

Fix: pass the JSON via an `env:` block (env values bypass shell quoting entirely)
and pipe it to the script using `printf '%s' "$COMMITS_JSON"`.

Closes #526.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/harness-replays.yml

@@ -74,6 +74,16 @@ jobs:
           # GitHub event variables, so no local history is needed.
           fetch-depth: 1
       - id: decide
+        env:
+          # Pass via env block — env values bypass shell quoting so single
+          # quotes in merge-commit messages (e.g. "Merge pull request 'fix: ...'
+          # from branch into main") cannot break the bash parser. The prior
+          # `echo '${{ toJSON(...) }}'` form broke on every main-push because
+          # every main commit is a merge commit with single quotes in the
+          # message body — the embedded `'` ended the single-quoted shell string
+          # mid-JSON, and a subsequent `(` (e.g. in `(#523)`) was parsed as a
+          # subshell, causing "syntax error near unexpected token `('".
+          COMMITS_JSON: ${{ toJSON(github.event.commits) }}
         run: |
           set -euo pipefail
 
@@ -98,7 +108,7 @@ jobs:
             # Gitea Compare API rejects SHA-to-branch comparisons (BaseNotExist),
             # so we use the commits array instead. This array contains all commits
             # in the push, each with their added/removed/modified file lists.
-            echo '${{ toJSON(github.event.commits) }}' \
+            printf '%s' "$COMMITS_JSON" \
               | bash .gitea/scripts/push-commits-diff-files.py \
               > .push-diff-files.txt 2>/dev/null || true
             DIFF_FILES=$(cat .push-diff-files.txt 2>/dev/null || true)