packaging: bare backticks — a heredoc's backslash isn't the JSON's

Run 2981 built everything and then died posting the release: HTTP 422,
"invalid escape sequence \`". The body's other backticks are written \` because
they sit in an UNQUOTED heredoc, where that backslash is the shell's and is gone
before any JSON exists. Copying the idiom into a single-quoted variable changed
what it meant — single quotes already stop substitution, so the backslash
survived into the body as an escape JSON has no rule for.

bash -n passes either way; it checks syntax, not what a string becomes. So parse
the assembled body for every branch it can take instead, and write down the
recipe next to the one for formatting Rust.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MKsUY9Z45KQd34V956hZ9Q

ci-requirements.md

@@ -183,3 +183,17 @@ bash -n desktop/packaging/publish-release.sh
 Where a script resolves URLs from the Forgejo API, exercise the resolution
 against the live instance (plain `curl` reads, no install) rather than trusting
 the regex by eye. Both channel paths in `install.sh` were verified that way.
+
+**Hand-assembled JSON: parse it before you push it.** `publish-release.sh` builds
+its request bodies as shell strings, and quoting context decides what survives
+into the JSON — a `` \` `` inside an unquoted heredoc loses its backslash to the
+shell, the same `` \` `` inside a single-quoted variable does not, and reaches
+Forgejo as an illegal escape (HTTP 422, one wasted build). `sh -n` cannot see
+this. Extract the body block and parse it for every branch it can take:
+
+```
+sed -n '/^# The install command printed/,/^JSON$/p' desktop/packaging/publish-release.sh > /tmp/body.sh
+echo ')' >> /tmp/body.sh
+bash -c 'GITHUB_SERVER_URL=https://git.fabledsword.com GITHUB_REPOSITORY=o/r \
+  TAG=dev RELEASE_PRERELEASE=true; . /tmp/body.sh; printf "%s" "$BODY" | python3 -m json.tool >/dev/null'
+```