Run the quickstart block through bash directly, not through a shell - #59

What

main is currently red on semgrep. The row-basis figure generator merged in #57 with
subprocess.run(..., shell=True), which the security-audit ruleset blocks
(python.lang.security.audit.subprocess-shell-true, docs/figures/make_row_basis.py:61). It is
the only blocking finding in the scan.

The block it runs is this repository's own README content, so this was never an injection risk —
but shell=True propagates the caller's shell settings for no benefit here, and carrying a
suppressed security finding in a repository whose whole subject is honest verification is the
wrong trade.

This invokes /bin/bash with an argument list instead. As a side benefit it picks up
-euo pipefail, matching exactly how the Quick start verified CI job runs the same block, so a
failing line inside it now fails figure generation too rather than passing silently.

# noqa: S603 replaces the old # noqa: S602: ruff's S603 fires on any subprocess call with a
non-literal element, and here that element is block, read from this repo's own README at the
commit being generated. The comment says so rather than just naming the code.

Verification

The semgrep registry is unreachable from the environment this was fixed in, and a --quiet run
against an unreachable registry loads zero rules and reports success — which is not a check
passing, it is a check not running. So the rule was reproduced locally instead:

• Original: fires at docs/figures/make_row_basis.py:61, the same line CI reported.
• This revision: silent.

Plus: both generated figures byte-identical after regenerating every docs/figures/make_*.py,
408 passed, ruff check . clean, ruff format --check . clean.

🤖 Generated with Claude Code