## Summary

Resolves the **2 open critical Dependabot alerts** (#165 and #166) for
`shell-quote`.

| Alert | Manifest | GHSA | Severity |
|-------|----------|------|----------|
| #165 | `package.json` | GHSA-w7jw-789q-3m8p | Critical |
| #166 | `pnpm-lock.yaml` | (same) | Critical |

`shell-quote < 1.8.4` does not escape newlines in object `.op` values
within `quote()`. Craft only uses `parse()` on developer-controlled
config strings (`.craft.yml` pre/post-release commands), so it was **not
actually exploitable** — but the bump clears the alerts.

## Changes

- **`package.json`**: `shell-quote` `1.7.3` → `^1.8.4`
- **`pnpm-lock.yaml`**: regenerated (resolves `1.8.4`)
- **`src/commands/publish.ts`**: normalized `import shellQuote from
'shell-quote'` → `import * as shellQuote from 'shell-quote'` to match
`prepare.ts` (correct form for a CJS module with no default export)

No breaking changes to `parse()` or the `ParseEntry` type between 1.7.3
and 1.8.4.

## Verification

- `pnpm build` ✅
- `pnpm test` ✅ (972 passed; the 7 `prepare-dry-run.e2e` failures are a
pre-existing env issue — `EDITOR` unset in headless CI — unrelated to
this change)
- `pnpm lint` ✅ (0 errors)