Handle quotes in fingerprint source paths

[justadityaraj]

Context

Fingerprint source globs are expanded after Task joins them to the task directory. The existing path escaping handled spaces and several shell metacharacters, but not a single quote, so an absolute directory such as test'd was parsed as unterminated shell syntax. The glob error is swallowed by the fingerprint layer, leaving no source matches and causing the task to rebuild every time.

Fixes #2874

Changes

• escape single quotes alongside the other literal path characters before shell expansion
• add a regression that fingerprints a file below a quoted directory name

User impact

sources and generates work normally when any directory in their absolute path contains a single quote.

Verification

• Regression on the base revision: expected the source path, received an empty result
• go test ./internal/fingerprint -count=1: passed
• go vet ./...: passed
• Committed Go files are unchanged by the configured formatter
• go test ./... -count=1: all changed-package tests passed; the root package retains the same 16 Windows-only failures seen on clean main from unavailable POSIX commands and symlink behavior

AI usage

OpenAI Codex assisted with tracing, implementation, and tests. The complete two-file diff was inspected and the issue's reproducer was verified before submission.