fix(image): escape the backticks in the apt-pin comment

The apt-pin block added in 62affa1 sits inside the chroot install script's
heredoc, which is unquoted (<<CHROOT_EOF) so the shell expands its body when
the script is written. The comment contained a backtick-quoted command name,
which would have been run as a command substitution on the BUILD HOST at
image-build time and its output spliced into the generated script.

Escaping them renders the comment literally, as intended. Checked the whole
heredoc body afterwards: no unescaped backticks remain anywhere in it, and
the pin block itself has no unescaped $, so it now renders verbatim.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: dkulp

SD/build-image-pi.sh

@@ -642,7 +642,7 @@ RASPI_FW_EOF
 # KERNEL=none stops raspi-firmware from *copying* a stock kernel into
 # /boot/firmware, but it does not stop apt from installing one in the first
 # place, and a Pi5/CM5 boots by filename: the firmware prefers
-# kernel_2712.img over kernel8.img. So a single `apt-get upgrade` that pulls
+# kernel_2712.img over kernel8.img. So a single \`apt-get upgrade\` that pulls
 # a newer linux-image-*-rpi-2712 is enough to put a 16K-page stock kernel
 # back on the boot partition, and the box then boots a kernel whose
 # /lib/modules tree was stripped above -- no modules at all, which shows up