fix(ci): harden filename handling in frontend-skills-qa.yml loops (SC2086 / word-splitting) #114

Problem

In .github/workflows/frontend-skills-qa.yml the readability and accessibility jobs iterate over filenames collected from find/glob using unquoted word-splitting:

• L52/L58: files=$(find ...) then for file in $files — breaks on spaces/newlines and is influenceable by PR-controlled filenames.
• L72: python3 ... "$threshold" "$file" reads from that loop.
• L88-89/L95: short_path (derived from filenames) is echoed with echo -e "$results" into $GITHUB_STEP_SUMMARY — echo -e interprets escapes, allowing minor step-summary spoofing.
• L182/L185: for file in examples/frontend/**/*.html with unquoted use.

Risk

Medium. A maliciously named file in a PR could break argument boundaries on the runner. Advisory job, no token escalation, but untrusted data flows into a shell loop and a logged sink.

Fix

• Use find ... -print0 with while IFS= read -r -d '' file; do ... done.
• Always double-quote "$file" / "$short_path".
• Prefer printf '%s' over echo -e for untrusted strings.

(Depends on / overlaps #113 which rewrites this file.)