fix(ci): pass commits-json as env var to avoid shell escaping

The sensor passes GitLab commit data containing single quotes in
commit messages (e.g. Merge branch 'feature-name'). When embedded
directly in the shell script via Argo template substitution, this
breaks the shell syntax. Pass as a container env var instead.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/argo/ci-pipeline-template.yaml

@@ -210,6 +210,9 @@ spec:
       container:
         image: rg.fr-par.scw.cloud/foxhunt-ci/foxhunt-runtime:latest
         command: ["/bin/sh", "-c"]
+        env:
+          - name: COMMITS_JSON
+            value: "{{workflow.parameters.commits-json}}"
         resources:
           requests:
             cpu: 100m
@@ -224,7 +227,7 @@ spec:
             #!/bin/sh
             set -e
 
-            COMMITS_JSON='{{workflow.parameters.commits-json}}'
+            # COMMITS_JSON is passed as env var to avoid shell escaping issues
 
             # Extract all changed file paths from commits array
             if command -v jq >/dev/null 2>&1; then