fix(security): harden run-steps against script injection; fix release gating

[peschee]

Summary

Hardens every reusable workflow and composite action against shell script injection, and fixes two release-workflow correctness bugs found during the review.

The core change is mechanical and repo-wide: every github.*, inputs.*, secrets.*, and vars.* value that was interpolated directly into a run: shell body is now passed via a step-level env: block and referenced as a quoted shell variable. This is the standard mitigation for GitHub Actions expression injection.

Security

• Script injection: all untrusted ${{ … }} moved out of run: bodies into env: (quoted refs) across every workflow + composite action.
• Secrets off command lines: Nexus credentials (curl --user), macOS keychain password, skopeo --src/--dest-creds, and the Jira auth token are no longer interpolated into command strings.
• add-helm-repositories: removed eval of a built-up command string; now uses a bash argument array.
• setup-npm-nexus-access: removed the step that printed the generated .npmrc (auth token) to the build log.

Fixed

• Release announce job was effectively never running: its condition was just inputs.send_announcement while it needs: several jobs that are skipped on a normal release, so it got skipped too. Now gated with always() && … && !contains(needs.*.result, 'failure'/'cancelled').
• Release run summary referenced non-existent uppercase parse outputs (rendered blank); now uses the correct lowercase outputs.

Verification

• actionlint clean across the tree (only the pre-existing macduff self-hosted-runner label warning).
• Injection scan confirms no untrusted inputs.*/secrets.*/github.event.* remains in any run: body. Remaining ${{ }} occurrences are safe (with:/env: values, the announce message: hardened inside its action, and a fixed-literal ternary in shared-maven-build.yml).

Notes / not in this PR

• This repo has no release/tag process — consumers ride @main, and package.json's 1.0.0 maps to no tag. The CHANGELOG entry is under [Unreleased]. Cutting an actual v1.0.0 (so this lands in a real release) is a separate decision.
• Scope was deliberately limited to injection/secrets + the announce gating. Other review findings (missing permissions: blocks, concurrency groups, unpinned third-party actions, the orphaned shared-* vs legacy duplication, the dead non-dot github/ dir, README link errors) are not addressed here.