secrets: silence two SC2016s that are the intended behaviour

shell-lint failed on two single-quoted strings. Both are deliberate and
double-quoting either one would break it silently rather than loudly.

In render_centralis_secrets, the verification step runs `bash -c 'set -a; . "$1"'`
with the rendered file passed as an argument. The "$1" must be expanded by that
inner shell. Double-quoted, it would interpolate the OUTER $1 — the function's
own first argument, the repo root — so the check would source the wrong path and
still report success. That check exists precisely to catch a bad render, so a
false pass there is worse than no check.

In verify-centralis-render.sh, the string is executed by the REMOTE shell over
ssh. Double-quoted, mktemp would run locally and the script would send the host
a path that does not exist there.

Suppressed with the reason at each site rather than loosened globally.

Claude-Session: https://claude.ai/code/session_0182KTMrsTHJc3TcewCatJFY

infra/deploy/render-secrets.sh

@@ -330,6 +330,11 @@ EMIT
     # environment, `set -a`, no inherited variables to mask a dropped key — and
     # read every value back out. This is the test that the file cannot pass while
     # carrying the 2026-07-24 bug, and it runs on every render, not once.
+    # shellcheck disable=SC2016  # single quotes are the point: "$1" must be
+    # expanded by the inner `bash -c`, against the argument passed after `_`,
+    # not by this shell. Double-quoting would interpolate the OUTER $1 — the
+    # function's own first argument, the repo root — and the check would then
+    # verify the wrong file, or nothing at all, while still reporting success.
     env -i PATH="$PATH" bash -c \
       'set -a; . "$1"; set +a; exec python3 -c "
 import json, os, sys

infra/deploy/secrets/verify-centralis-render.sh

@@ -30,6 +30,10 @@ VAULT="deploy/secrets/centralis.${ENV_NAME}.yaml"
 SSH=(ssh -i "$SSH_KEY" "$SSH_TARGET")
 SCP=(scp -q -i "$SSH_KEY")
 
+# shellcheck disable=SC2016  # single quotes are required: this whole string is
+# executed by the REMOTE shell, so $d and the command substitution must survive
+# the trip intact. Double-quoting would run mktemp locally and then send a path
+# that does not exist on the host.
 scratch="$("${SSH[@]}" 'd=$(mktemp -d) && chmod 700 "$d" && mkdir -p "$d/deploy/secrets" && echo "$d"')"
 [ -n "$scratch" ] || { echo "!! could not create a scratch dir on the host" >&2; exit 1; }
 cleanup() { "${SSH[@]}" "rm -rf -- '$scratch'" >/dev/null 2>&1 || true; }