Script injection in Actions: stop interpolating expressions into run steps

# The vulnerability
Values from the GitHub context, like a pull request title or issue body, are attacker-controlled. Interpolating them into a run script builds shell code out of untrusted input. A crafted title can break out of your quoting and run arbitrary commands with the workflow's permissions.

# The bad pattern
A run step like: echo "Title is ${{ github.event.issue.title }}"
If the title contains shell metacharacters, that echo line becomes whatever the attacker wants it to be.

# The fixes, from GitHub's own hardening guide
1. Preferred for inline scripts: copy the value into an intermediate environment variable, then reference the variable. The value stays data, never code:
   env:
     TITLE: ${{ github.event.pull_request.title }}
   and then use "$TITLE" in the script body.
2. Better for complex handling: write a small JavaScript action that takes the value as an input argument. The value is passed as data to the action and never interpolated into a script, so injection is structurally impossible.

# Checks
- Grep workflows for expression interpolation inside run blocks. Every interpolation of event data is suspect.
- Treat issue titles, PR titles and bodies, branch names, and commit messages as untrusted, always.