ci: fix jenkins shell quoting and enforce bash for pipeline scripts

Jenkinsfile

@@ -108,7 +108,7 @@ spec:
       steps {
         container('tester') {
           sh '''
-            bash -lc '
+            #!/usr/bin/env bash
             set -euo pipefail
             apt-get update >/dev/null
             apt-get install -y --no-install-recommends xz-utils >/dev/null
@@ -131,7 +131,6 @@ with open("build/coverage.json", "w", encoding="utf-8") as handle:
     json.dump({"summary": {"percent_covered": coverage}}, handle)
 PY
             exit ${test_rc}
-            '
           '''
         }
       }
@@ -141,6 +140,7 @@ PY
       steps {
         container('publisher') {
           sh '''
+            #!/usr/bin/env bash
             set -euo pipefail
             python scripts/publish_test_metrics.py
           '''
@@ -152,6 +152,7 @@ PY
       steps {
         container('builder') {
           sh '''
+            #!/usr/bin/env bash
             set -euo pipefail
             mkdir -p /root/.docker
             cp /docker-config/config.json /root/.docker/config.json
@@ -165,6 +166,7 @@ PY
         container('builder') {
           script {
             sh '''
+              #!/usr/bin/env bash
               set -euo pipefail
               SEMVER="0.1.0-${BUILD_NUMBER}"
               echo "SEMVER=${SEMVER}" > build.env
@@ -181,6 +183,7 @@ PY
       steps {
         container('builder') {
           sh '''
+            #!/usr/bin/env bash
             set -euo pipefail
             for i in $(seq 1 10); do
               if docker info >/dev/null 2>&1; then
@@ -198,6 +201,7 @@ PY
       steps {
         container('builder') {
           sh '''
+            #!/usr/bin/env bash
             set -euo pipefail
             VERSION_TAG="$(cut -d= -f2 build.env)"
             for arch in amd64 arm64; do