#4099 Docs: data-origin values in command/shell run are passed as environment references (swamp-club#3868)

swamp-club#3868 changes how values that come from data (caller and webhook inputs, data reads, step outputs, env) are spliced into a command/shell run: each reaches the shell as one literal word through a generated environment variable instead of being parsed as shell syntax. Authored text is unchanged.

Pages to update:

• content/manual/reference/cel-expressions.md: in the section on splicing into command/shell, state the one-literal-word rule, the refusal inside a quoted heredoc delimiter (POSIX) and PowerShell single quotes, and the workaround for word splitting or deliberate code: put the value in the behavior env field and reference the variable in run (unquoted for word splitting; eval for code).
• content/manual/how-to/set-up-webhooks.md: note that webhook payload fields mapped through trigger.inputs are data, and are passed to command/shell runs as environment references, never as syntax.

Source of truth once merged: design/enablers/expressions.md, Shell Safety.