builder: fix escaping for ENV variables.

/cc @tiborvass 

closes #8636 
could this ever panic bc the +2?