`systemd` has its own environment variable expansion. In this case, we never want the input to be interpreted this way, so we escape it. At this time, we support some GitHub Actions images that have a version of systemd too old to pass `--expand-environment=no`, so I read the manual to look for signs that there were any other bytes that needed escaping. Only finding `$` requires doubling, I implement that here.