fix(ops): harden provenance gate path and command parsing

Co-authored-by: genichin <4282227+genichin@users.noreply.github.com>

scripts/release_provenance_gate.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import shlex
 from datetime import UTC, datetime
 from pathlib import Path
 
@@ -26,7 +27,7 @@ def _parse_capture_command(raw: str) -> tuple[str, list[str]]:
         raise ValueError("capture command must be KEY=command")
     key, command = raw.split("=", 1)
     key = key.strip()
-    parts = [x for x in command.strip().split(" ") if x]
+    parts = shlex.split(command.strip())
     if not key or not parts:
         raise ValueError("capture command must be KEY=command")
     return key, parts