[SandObserver]

Summary

• Pass the repository name and default branch to ca-validate.py through env in both CA template workflows, instead of expanding ${{ }} inside run:.
• Add a workflow hardening test that fails on any ${{ }} expression inside a run: script, in every workflow and composite action.

Testing
All green. The new test fails on the previous workflow.

Changelog

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.