env: add support for escaping environment substitutions

ugh, this is such a mess of escaping, but I guess it's hard to test the various permutations of newlines etc. with raw string literals :/