Ok, I think I have a working solution.  I got rid of the separate sh_string state I created and instead mimicked what Andy Eskilsson did in his python state:

state sh_string extends Highlight
{
  /\\\\./ {
    language_print ($0);
  }
  sh_string_end {
    language_print ($0);
    return;
  }
}

Then I have sh_string_end set to a regular expression.

state sh extends HighlightEntry
{
  <snip>
  /* String constants. */
  /\"|'/ {
    sh_string_end = regexp($0);
    string_face (true);
    language_print ($0);
    call (sh_string);
    string_face (false);
  }
  <snip>
}

This correctly highlights nested single and double quotes, as well as hash/pound symbols inside quotes.  See the attached state file for more details.

(file #18250)

Ah, no.  My changes cause problems with lines like these:

printf "Found the following differences between today and yesterday's "

Everything after the single quote returns to the plain, non-string style.