test: assert domain payload never parses as a shell operator (drop literal check)

quote() legitimately wraps the payload text inside single quotes, so the raw
substring is present but inert. leaksShellSyntax (via shell-quote parse) is the
correct assertion; the literal not.toContain check was wrong.

apps/dokploy/__test__/compose/domain-command-injection.test.ts

@@ -50,8 +50,9 @@ describe("writeDomainsToCompose error path (GHSA-xmmr serviceName injection)", (
 
 		// The service does not exist in the compose, so we hit the error branch.
 		expect(result).toContain("Has occurred an error");
+		// The payload text may appear inside the single-quoted echo argument, but
+		// it must never parse as a shell operator ($(), backtick, ; …).
 		expect(leaksShellSyntax(result, "touch")).toBe(false);
-		expect(result).not.toContain("$(touch");
 	});
 
 	it("neutralizes backtick and semicolon payloads too", async () => {