Move release and tag version into env vars to prevent template injection

[adamtheturtle]

Moves steps.calver.outputs.release and steps.tag_version.outputs.new_tag into environment variables in run/command blocks to prevent template injection, following GitHub's recommended security pattern.

See: https://docs.github.com/en/actions/concepts/security/script-injections

---

Note

Low Risk
Workflow-only changes that adjust how GitHub Actions expressions are passed into shell scripts; low functional risk but could break releases/CI if variables are miswired.

Overview
Hardens the release.yml workflow by moving steps.*.outputs.* values used inside run blocks (e.g., release version for changelog underline and modifiedFiles check) into env vars before shell evaluation.

Updates test.yml to pass strategy.job-index via JOB_INDEX and use it in the secrets-file copy command, reducing direct expression interpolation in shell.

Removes the template-injection suppression from zizmor.yml so the repo’s workflow security linter can flag these issues going forward.

^{Written by Cursor Bugbot for commit 07d92f9. This will update automatically on new commits. Configure here.}