Quote the here-document delimiter in dotenv:update to prevent shell expansion of secret values

[tannyl]

dotenv:update writes .env..local with an unquoted here-document (cat <<EOT), so the shell performs parameter expansion and command substitution on the body before it's written.

• Values with $, backticks or \ are mangled — e.g. APP_SECRET=0ur_$t4g1g1n6_$3cr37 becomes 0ur_cr37.
• Values with $(...) or backticks have arbitrary commands executed during deploy.

Quoting the opening delimiter (cat <<'EOT') makes the body literal and fixes both; the closing delimiter stays the bare EOT. 2.x already avoids this via file_put_contents + upload — this is the minimal 1.x backport.