Not a full writeup.  I didn't solve this but wanted to share the parenthesis bypass that I did come up with.
Name: sam
Email: `"{{request.application['__globals__'].__builtins__.__import__﹙'os'﹚.popen﹙'cat flag.txt'﹚.read﹙﹚}}"@m.edu`
Here the symbols that look like ( and ) are actually high-unicode characters: SMALL LEFT/RIGHT PAR­EN­THE­SIS0xFE59 and 0xFE5A
See [this page](https://unicode-search.net/unicode-namesearch.pl?term=PARENTHESIS)
These get past the filter but must "turn into" regular parenthesis when the expression is evaluated.  I'm not sure why.
The email syntax checker allows certain characters ONLY if the portion to the left of the @ is surrounded by double-quotes.