Define script variables ahead of the script body

[cdcme]

What's changing

Resolved $FLEET_VAR_* values were interpolated into script contents without being escaped for the target interpreter, so characters that are meaningful to it weren't treated as literal text.

Values are now delivered so the interpreter reads them as data. Shell and PowerShell get them defined ahead of the script body, with the $FLEET_VAR_* token left in place. Python has no $VAR expansion, so its values are substituted in escaped form.

No agent changes, so this works on hosts running today's fleetd.

Behavior changes

• $FLEET_VAR_* inside single quotes or a quoted heredoc is no longer substituted and stays a literal token. Same for PowerShell '...' and here-strings.
• In Python, variables work inside string literals, but not inside raw (r"...") or bytes (b"...") literals.
• Values are no longer re-expanded by the interpreter. A value of $HOME prints $HOME.

Checklist for submitter

• Changes file added for user-visible changes in changes/.
• Untrusted data interpolated into scripts is validated against interpreter metacharacters.

Testing

• Added/updated automated tests
• Where appropriate, automated tests simulate multiple hosts and test for host isolation (updates to one hosts's records do not affect another)
• QA'd all new/changed functionality manually

Unit tests cover each escaper and the preamble placement rules. Exec tests run generated scripts through /bin/sh, bash, zsh, and python3 and assert values round-trip byte-for-byte, including under a non-UTF-8 locale.

Manual pass against a live server, 17/17 checks across shell, PowerShell, Python, and a .py script-only package.

Gaps: PowerShell was checked on 7.4 in Docker, not Windows PowerShell 5.1, so a real Windows pass is still needed. ConstrainedLanguage was simulated with LanguageMode, not enforced by WDAC.