fix: satisfy refs guard shellcheck

actions/refs-not-closing/run.sh

@@ -12,6 +12,8 @@ name="${GITHUB_REPOSITORY#*/}"
   exit 1
 }
 
+# GraphQL variables are literal API syntax; the shell must not expand them.
+# shellcheck disable=SC2016
 facts="$(gh api graphql \
   -f query='query($owner: String!, $name: String!, $number: Int!) {
     repository(owner: $owner, name: $name) {

test/refs-not-closing.test.sh

@@ -143,7 +143,7 @@ one_graphql_read() {
 check "action performs exactly one GraphQL read" 0 "1" \
   one_graphql_read
 check "composite delegates to the tested entrypoint" 0 "run.sh" \
-  grep -F 'run: bash "$GITHUB_ACTION_PATH/run.sh"' "$ACTION"
+  grep -F "run: bash \"\$GITHUB_ACTION_PATH/run.sh\"" "$ACTION"
 
 check "workflow wakes on body edits" 0 "types: [opened, edited, reopened, synchronize]" \
   grep -F "types: [opened, edited, reopened, synchronize]" "$WORKFLOW"