fix(workflows): preserve commas inside quoted list-literal elements

[jawwad-ali]

Description

The workflow simple-expression evaluator parsed list literals with a naive inner.split(","):

# src/specify_cli/workflows/expressions.py
items = [_evaluate_simple_expression(i.strip(), namespace) for i in inner.split(",")]

That splits on commas inside quoted strings (and nested brackets), so a list element containing a comma is silently broken into multiple elements:

• {{ ["a, b", "c"] }} → ["a", "b", "c"] (3 items) instead of ["a, b", "c"] (2 items)
• {{ ["x, y, z"] }} → ["x", "y", "z"] instead of ["x, y, z"]

This silently corrupts any list expression with a comma inside a quoted element — most importantly a fan-out step's items:, where it changes the number of iterations and the data passed to each one, with no error raised.

Fix

Split list-literal elements on top-level commas only, ignoring commas inside quotes or nested brackets, via a small _split_top_level_commas helper. Per-element evaluation is unchanged (elements can still be variables, nested lists, etc.), and plain/empty lists behave exactly as before.

Testing

• Tested locally with uv run specify --help (exit 0)

• Ran existing tests with uv sync && uv run pytest

• uvx ruff check src/ — All checks passed

• uv run pytest tests/test_workflows.py — 295 passed, 1 skipped; the only failures on my Windows host are the pre-existing os.symlink WinError 1314 privilege tests (unrelated to this change).

• New test tests/test_workflows.py::TestExpressions::test_list_literal_preserves_quoted_commas covers quoted commas, nested lists, and the existing plain/empty cases. It fails on main (["a", "b", "c"]) and passes with this fix.

AI Disclosure

• I did not use AI assistance for this contribution
• I did use AI assistance (describe below)

Found and fixed with Claude Code (Claude Opus 4.8) under my direction. AI located the naive split, implemented the quote/bracket-aware helper, and wrote the tests; I confirmed the corruption reproduces on main and that the fix resolves it (and is a no-op for plain lists) before submitting. I'll disclose if any review responses are AI-assisted as well.