refactor(ssh): trim shellQuote test cases and tone down godoc framing

Tests collapsed from 8 cases to 3 (no special chars, embedded quote,
spaces) the rest were redundant security-themed variants of the
same path. Godoc reframes shellQuote as path-handling robustness
rather than security mitigation; consumers control all inputs in
test code.

Linear: OSS-3397

Author: james00012

modules/ssh/ssh.go

@@ -655,9 +655,9 @@ func FetchContentsOfFileContext(t testing.TestingT, ctx context.Context, host *H
 	return out
 }
 
-// shellQuote returns s wrapped in single quotes, with any embedded single quote
-// replaced by the four-character sequence quote-backslash-quote-quote.
-// Safe for POSIX sh, bash, zsh.
+// shellQuote wraps a path in single quotes, escaping any embedded single quotes,
+// so that paths containing spaces or shell metacharacters work correctly when
+// passed to commands like `cat` and `dd if=`.
 func shellQuote(s string) string {
 	return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'"
 }

modules/ssh/ssh_unit_test.go

@@ -20,12 +20,7 @@ func TestShellQuote(t *testing.T) {
 			expected: "'/etc/hostname'",
 		},
 		{
-			name:     "empty string",
-			input:    "",
-			expected: "''",
-		},
-		{
-			name:     "single quote",
+			name:     "embedded single quote",
 			input:    "it's",
 			expected: `'it'\''s'`,
 		},
@@ -34,26 +29,6 @@ func TestShellQuote(t *testing.T) {
 			input:    "/path with spaces/file.txt",
 			expected: "'/path with spaces/file.txt'",
 		},
-		{
-			name:     "path traversal attempt",
-			input:    "a; rm -rf /",
-			expected: "'a; rm -rf /'",
-		},
-		{
-			name:     "command substitution attempt",
-			input:    "$(rm -rf /)",
-			expected: "'$(rm -rf /)'",
-		},
-		{
-			name:     "backtick attempt",
-			input:    "`rm -rf /`",
-			expected: "'`rm -rf /`'",
-		},
-		{
-			name:     "injection with embedded single quote",
-			input:    "'; rm -rf / #",
-			expected: `''\''; rm -rf / #'`,
-		},
 	}
 
 	for _, tc := range testCases {