Fix: prevent script injection in release.yml via env-var indirection (#8)

• Fix: prevent script injection in release.yml via env-var indirection

The release.yml workflow interpolated untrusted workflow_dispatch inputs (github.event.inputs.version_number and .commit_id) directly into run: shell commands. An attacker able to trigger the workflow could inject arbitrary shell via these inputs (ACAT rule acat-guru/GithubWorkflowIdentifier, CWE-94 GitHub Actions expression injection, SEV_3).

Fix binds the untrusted inputs to job-level env: vars and references them as “$VERSIO{N}_{N}UM\mathrm{"}\mathrm{/}\mathrm{"}VERSION\_NUM"\; /\; "$COMMIT_ID” inside run: blocks, so values are passed through the shell environment instead of being expanded into the script text. This mirrors the repo’s existing safe pattern in the clean-existing-tag-and-release job.

• add-sbom-and-tag-commit: add env VERSION_NUM, COMMIT_ID
• create-zip: add env VERSION_NUM
• replace all github.event.inputs interpolations in run: blocks with quoted env-var references

No functional change to workflow behavior. github.actor lines and the clean-existing-tag-and-release job are unchanged.

Ref: ticket V2283451955

• Harden github.actor in release.yml via env-var indirection

Binds github.actor to job-level GH_ACTOR env var and references “$GH_ACTOR” in the Configure git identity step, completing removal of raw github-context interpolation from all run: blocks (defense-in-depth beyond the 6 ACAT findings). Reference ticket V2283451955.