[BryanFRD]

Closes #401

Same treatment as #273: every caller input and step output that was expanded into a run: block in the reusables and the two composite actions is now passed through env: and referenced as a shell variable. *-args inputs keep their word splitting (unquoted), matching the rust reusable.

zizmor template-injection findings on .github: 42 before, 0 after. All run blocks still pass bash -n. The repo has no test setup.

[ferrfleet-interne]

The changes are correct. Word splitting still works where it has to: arg lists and script-runner like pnpm run are left unquoted, single values are quoted, and the PowerShell ${env:BIN_NAME} form is right. The only remaining ${{ }} in these run blocks are matrix values, runner.temp and step outputs, none of which a caller controls.

Nit: this is outside the diff, but reusable-release-rust.yml still has cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }} in a run block. You could move it to env: CARGO_REGISTRY_TOKEN: ... and drop --token, since cargo reads that variable on its own.