Move release and tag version into env vars to prevent template injection

[adamtheturtle]

Moves steps.calver.outputs.release and steps.tag_version.outputs.new_tag into environment variables in run/command blocks to prevent template injection, following GitHub's recommended security pattern.

See: https://docs.github.com/en/actions/concepts/security/script-injections

Made with Cursor

---

Note

Medium Risk
Low-code change but touches the release/publish GitHub Actions workflow; mistakes could break tagging, changelog updates, or artifact builds during releases.

Overview
Tightens the release.yml workflow to avoid GitHub Actions expression interpolation inside shell scripts by passing step outputs (e.g., calver release, changelog modifiedFiles, and tag new_tag) via env variables and referencing them in run blocks.

Updates zizmor.yml by removing the template-injection rule disable, allowing the linter to flag this class of issue going forward.

^{Written by Cursor Bugbot for commit fa2cb9a. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}