fix(rewrite): preserve quoted assignment data

[zhiwuyazhe-fjr]

Summary

• prevent the environment-prefix regex from backtracking into quoted assignment values and exposing literal data as a command
• preserve valid shell values composed from quoted and unquoted fragments
• add regressions for the original shellcheck corruption, single- and double-quoted assignment data, and real commands outside the quoted value

Root cause

The lexer kept the quote boundaries and byte offsets correctly. The corruption happened later in ENV_PREFIX: when a complete quoted assignment did not satisfy the trailing-whitespace requirement at a compound-command boundary, the regex could fall back to the broad unquoted alternative and match only D='# . The remaining literal text then began with shellcheck and was rewritten as a command.

The unquoted fragment now excludes quote characters, while the environment value accepts a sequence of complete quoted or unquoted fragments. This prevents partial reinterpretation without regressing valid forms such as FOO='bar baz'qux git status.

This is independent of #3202's case-terminator lexer fix.

Security behavior

The original #3262 payload now passes through unchanged. A supported command outside the quoted assignment is still rewritten:

D='# shellcheck | git status; $(whoami)' ; cargo test
  -> D='# shellcheck | git status; $(whoami)'; rtk cargo test

Test plan

• Red-first regression reproduced D='# rtk shellcheck ...' before the fix
• cargo fmt --all -- --check
• cargo clippy --all-targets
• cargo test --all: 2574 passed, 0 failed, 8 ignored
• manual rtk hook claude verification:
  • original payload: exit 0, empty output (safe passthrough)
  • quoted assignment plus external cargo test: quoted bytes preserved, command rewritten

Closes #3262