Quote remote release-tool command arguments

[e-q]

Summary

• Quote environment values and remote paths before building release upload command strings.
• Preserve intended glob expansion for staged release artifact copies.
• Quote URL-derived Windows upload paths before passing them to SSH/SCP helpers.
• Add mocked regression tests for the generated SSH and upload command strings.

Closes #397 (release tooling remote command arguments)
Closes #401 (Windows upload URL-derived remote paths)

Testing

• Focused tox regression tests for generated remote command quoting: passed.
• tox -q -e mypy: passed.
• Ruff lint and whitespace checks on touched files: passed.

[python-cla-bot]

All commit authors signed the Contributor License Agreement.