Signed Pipelines fail to verify when using interpolated environment variables

**Is your feature request related to a problem? Please describe.**
Currently, signed pipelines fail to verify if uploading a definition that contains a variable such as `${VAR_NAME}` in the command.

**Describe the solution you'd like**
Variables are supported in pipelines with risks and tradeoffs documented and mitigation options available.

**Describe alternatives you've considered**
Not using variables at all or only interpolating them from within wrapper scripts is a significant effort that would require rework across a large number of pipelines.

**Additional context**
There's some complexity in this because simply accepting any variable content could lead to a trivial bypass of the signature while evaluating the variable at signature time might lead to a different result compared to a runtime evaluation. However, the current situation is an edge case the pipeline signature feature has not addressed yet, so some explicit solution would be needed here.

No files, tests, or entry points are named. Start by locating the signed-pipeline verification and environment-variable interpolation paths, then review the existing signature behavior and documented risks. Done requires an explicit, agreed-upon treatment of interpolated variables that preserves meaningful signature verification.

Written by the indexing model from the issue text.