build-lectures: shell safety (drop eval, quote inputs)

[mmcky]

The build command is assembled by string interpolation and run through eval.

• M10 — Drop eval, quote inputs. build-lectures/action.yml:113 runs eval $BUILD_CMD built from interpolated source-dir/output-dir (line 97). Any space/metachar breaks it. Invoke jb build directly with quoted args.
• L17 — output-dir default. Default is './' (action.yml:21) → build path .//_build/html. Change default to ..
• L22 — extra-args tokenization. Interpolated raw (line 97); quoted strings with spaces mis-tokenize. Standard CI caveat — document or accept once M10 lands.

Filed from the 2026-06-16 technical review.