project-auto-status: the PR body is pasted into a shell script #1579

.github/workflows/project-auto-status.yml, job pr-merged, step "Move closed issues to Done", runs BODY='${{ github.event.pull_request.body }}'. GitHub substitutes the PR body into the script text before bash runs it, so:

• an apostrophe in a PR body breaks the step. It failed on blog: every post carries a widget, as a t27 rule the work report enforces (Closes #1576) #1577;
• any shell in a PR body runs with PROJECT_TOKEN in the environment. Fork PRs are excluded, so this takes someone who can push branches here, which includes agents and bees.

Fix: pass the body through env: and read $PR_BODY, the same way dev-enforcement.yml already passes the PR title. No other workflow in this repo pastes a PR or issue body or title into a script.