buildenv: escape arguments for SSH

This should be more robust than updating the callers as was done in #13.