fix(engine-tools): quote input file paths in update_expected.py

Shell metacharacters in a discovered file name were interpreted by the
shell, allowing command execution from the file name alone.

Assisted-By: Claude Opus 5 (1M context) <noreply@anthropic.com>