Make release APK metadata check shell-safe

[turin-dev]

Summary

• keep the exact package/version metadata gate safe inside the nested release container shell
• build the regex quote character with printf "\\047" so outer shell quoting cannot terminate early
• retain exact field-boundary checks for the package name and tag version

Verification

• local matcher accepts the expected aapt line
• local matcher rejects package suffixes, version prefixes, and version suffixes
• git diff --check passes

This fixes the release run failure after unsigned APK assembly on agent-v0.1.0; the official signing step itself had already succeeded in the prior run.