Fix ShellCheck findings in lib-deps-check and update-doc-db workflows (#7669)

Clear four of the five ShellCheck findings reported in #7653. The
fifth finding is in upgrade-pylib.lock.yml — a gh-aw-generated file
marked "DO NOT EDIT" whose source .md does not contain the flagged
pattern — and is out of scope here; it will resolve via the in-flight
gh-aw version bump (#7650).

lib-deps-check.yaml:
  * SC2076: replace `=~ " $module "` (quoted regex interpreted
    literally) with `== *" $module "*` glob match. Same intent
    (literal substring), same semantics across regex metachars.
  * SC2086: quote `$GITHUB_OUTPUT` in the output redirect.

update-doc-db.yml:
  * SC2129: collapse the eight sequential `echo ... >> $OUTPUT_FILE`
    lines (plus one `cat ... >> $OUTPUT_FILE`) into a single grouped
    redirect `{ ...; } > "$OUTPUT_FILE"`. Drops the now-redundant
    `echo -n '' > $OUTPUT_FILE` truncate.
  * SC2016: add `# shellcheck disable=SC2016` above the block; the
    backticks in the auto-generated-header comment are literal
    Markdown, not command substitution.

Verified locally with shellcheck 0.11.0: both modified blocks
produce no ShellCheck output. Semantic equivalence of the
lib-deps-check change confirmed across six test inputs including
regex metachars and glob-meaningful characters.

.github/workflows/lib-deps-check.yaml

@@ -71,14 +71,14 @@ jobs:
               # Lib files: Lib/foo.py -> foo, Lib/foo/__init__.py -> foo
               module=$(echo "$file" | sed -E 's|^Lib/||; s|/__init__\.py$||; s|\.py$||; s|/.*||')
             fi
-            if [[ -n "$module" && ! " $modules " =~ " $module " ]]; then
+            if [[ -n "$module" && " $modules " != *" $module "* ]]; then
               modules="$modules $module"
             fi
           done
 
           modules=$(echo "$modules" | xargs)  # trim whitespace
           echo "Detected modules: $modules"
-          echo "modules=$modules" >> $GITHUB_OUTPUT
+          echo "modules=$modules" >> "$GITHUB_OUTPUT"
 
       - name: Setup Python
         if: steps.changed-files.outputs.modules != ''

.github/workflows/update-doc-db.yml

@@ -87,17 +87,16 @@ jobs:
 
           OUTPUT_FILE='crates/doc/src/data.inc.rs'
 
-          echo -n '' > $OUTPUT_FILE
-
-          echo '// This file was auto-generated by `.github/workflows/update-doc-db.yml`.' >> $OUTPUT_FILE
-          echo "// CPython version: ${PYTHON_VERSION}" >> $OUTPUT_FILE
-          echo '// spell-checker: disable' >> $OUTPUT_FILE
-
-          echo '' >> $OUTPUT_FILE
-
-          echo "pub static DB: phf::Map<&'static str, &'static str> = phf::phf_map! {" >> $OUTPUT_FILE
-          cat crates/doc/generated/raw_entries.txt >> $OUTPUT_FILE
-          echo '};' >> $OUTPUT_FILE
+          # shellcheck disable=SC2016
+          {
+            echo '// This file was auto-generated by `.github/workflows/update-doc-db.yml`.'
+            echo "// CPython version: ${PYTHON_VERSION}"
+            echo '// spell-checker: disable'
+            echo ''
+            echo "pub static DB: phf::Map<&'static str, &'static str> = phf::phf_map! {"
+            cat crates/doc/generated/raw_entries.txt
+            echo '};'
+          } > "$OUTPUT_FILE"
 
       - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with: