I tried a bunch of clever/terser ways but they all ran into 'Unsafe Usage of Dynamic String' or phutil_passthru quoting even the empty string.

Does something like this work to slightly increase terseness/cleverness?

$flags = array();
if (have_version) {
  $flags[] = '--no-verify';
}

$err = phutil_passthru(
  'git push %Ls -- %s %s:refs/tags/%s',
  $flags,
  $staging_uri,
  $commit,
  $tag);

(I'd also sort of like to centralize the version check stuff, but this is fine as is until I get around to it.)

I think they previously didn't work like that (empty array threw an exception?) but we changed the behavior specifically to make this construction (or similar constructions?) easier, IIRC.

There's a sort-of-potentially-bad case where you execute rm -rf %Ls and the array is empty but you didn't realize it, and the behavior of rm with no arguments is very different/much worse than the behavior with one argument (for rm, specifically, it isn't, but for some other command it might be), and you destroy everything on your system or something, but we now have a bunch of callsites where this version of the API is making flag handling easier and safer, and the stars have yet to align to produce a problematic case where some hypothetical command activates "terrible catastrophe mode" when passed no arguments, so I think the moderate reduction in API safety for a great increase in API utility was good on the balance.