Harden composite action against shell expression and env-file injection - #66

The hardening report identified high-severity injection risks in action.yml: GitHub expressions were interpolated directly inside shell commands, and repository-derived data was written to $GITHUB_ENV without newline sanitization. This change scopes untrusted values to step environment variables and sanitizes env-file output paths.

• Expression isolation in run:

  • Moved runtime expressions (inputs.*, github.*, runner.*) into env: and referenced only shell variables in the script.
  • Eliminates direct ${{ ... }} interpolation inside command execution paths.

• Env-file injection mitigation

  • Sanitizes repository-derived values with tr -d '\n\r' before composing KO_DOCKER_REPO.
  • Writes only sanitized content to $GITHUB_ENV.

• Minor command safety cleanup

  • Quoted release download URL expansion for safer shell handling.

env:
  KO_VERSION: ${{ inputs.version }}
  USE_SUDO: ${{ inputs.use-sudo }}
  GH_TOKEN: ${{ github.token }}
  RUNNER_OS: ${{ runner.os }}
  RUNNER_ARCH: ${{ runner.arch }}
  GITHUB_REPOSITORY: ${{ github.repository }}
run: |
  repo=$(printf '%s' "${GITHUB_REPOSITORY}" | tr -d '\n\r' | tr '[:upper:]' '[:lower:]')
  ko_docker_repo=$(printf 'ghcr.io/%s' "${repo}")
  echo "KO_DOCKER_REPO=${ko_docker_repo}" >> "${GITHUB_ENV}"