fix(test): silence the two lint classes the new backend suite introduces

SC2016 on the deliberate single-quoted bash -c (the expansion belongs to
the isolated process, as the sibling case in issueflow-reconcile.test.sh
already documents), and SC2317 on the curl stub, which shellcheck cannot
see is invoked indirectly by forge_api.

Found only after committing, because .github/scripts/shellcheck-all.sh
derives its lint set from `git ls-files` — an UNTRACKED file is not linted
at all. "Gates clean" measured before `git add` was measuring a set that
excluded the file just written. Verified from a clean clone at the pushed
SHA, which is what caught it.

Refs #188

test/forge-backends.test.sh

@@ -27,6 +27,7 @@ check "select forgejo loads the forgejo backend" 0 "" \
   bash -c '. '"$ROOT"'/lib/forge.sh; forge_select forgejo; declare -f forgejo_page_url >/dev/null'
 check "select refuses an unknown forge" 1 "unknown forge" \
   bash -c '. '"$ROOT"'/lib/forge.sh; forge_select gitlab'
+# shellcheck disable=SC2016 # $FORGE expands in the isolated bash -c process
 check "select with no argument reads the environment" 0 "" \
   bash -c 'CEREMONY_FORGE=forgejo; . '"$ROOT"'/lib/forge.sh; forge_select; [ "$FORGE" = forgejo ]'
 
@@ -78,6 +79,7 @@ fake_forge() {
   FAKE_TOTAL="$1"; shift
   FAKE_PAGES=("$@")
   FAKE_CALLS=0
+  # shellcheck disable=SC2317 # the stub is invoked indirectly, by forge_api
   curl() {
     local hdr="" out="" url=""
     while [ $# -gt 0 ]; do