fix(cli): escape metadata in generated scripts

[hannibal-lee]

Summary

• encode Hugging Face model IDs, GGUF filenames, and quantization types as
  Python literals before embedding them in generated scripts
• apply the same escaping to both whichllm run and whichllm snippet
• add regression tests for metadata containing quotes and Python-like text

Why

whichllm run generates a temporary Python script from Hugging Face metadata
and executes it. Direct string interpolation could produce invalid Python or
allow specially crafted metadata to alter the generated code structure.

Using repr() through the !r conversion preserves the original value while
emitting a correctly escaped Python string literal. Normal model IDs and
filenames keep the same runtime behavior.

Testing

• uv run --no-dev --with pytest pytest -q (468 passed)
• uvx ruff check .
• uvx ruff format --check .