Quote remote release-tool command arguments

[e-q]

Summary

• Quote environment values and remote paths before building release upload command strings.
• Preserve intended glob expansion for staged release artifact copies.
• Quote URL-derived Windows upload paths before passing them to SSH/SCP helpers.
• Add mocked regression tests for the generated SSH and upload command strings.

Closes #397 (release tooling remote command arguments)
Closes #401 (Windows upload URL-derived remote paths)

Testing

• Focused tox regression tests for generated remote command quoting: passed.
• tox -q -e mypy: passed.
• Ruff lint and whitespace checks on touched files: passed.

[python-cla-bot]

All commit authors signed the Contributor License Agreement.

[sethmlarson]

@e-q Overall comment: Instead of introducing shlex.quote() everywhere is there value instead in changing functions to accept a list of parameters instead of a str and calling shlex.join before sending the command? Then we don't have to rely on remembering to call shlex.quote() everywhere.

[e-q]

Gotcha, I refactored this so the SSH helpers now accept command argument lists and call shlex.join() at the execution boundary instead of requiring each call site to remember shlex.quote().

For the two places that intentionally need remote shell glob expansion, the updated version uses static sh -c snippets and passes the dynamic paths as positional arguments. That keeps the wildcard behavior explicit while still joining the dynamic values centrally.