Guard against shell injection via github.ref in image workflow

[ChrisJBurns]

Summary

• image-build-and-publish.yml interpolated ${{ github.ref }} / ${{ github.ref_name }} directly into bash if/elif checks and variable assignments. Git ref names can legally contain shell metacharacters ($, `, (, ), ;, etc.), so a maliciously-named branch or tag could inject commands into these steps. The steps run with packages: write and id-token: write permissions (GHCR push + Cosign signing), so the blast radius is our image-signing/publish credentials.
• Reachable today via manual workflow_dispatch (any existing ref) or a published release (tag name), both of which require push/release access to the repo. Not reachable via pull_request/fork PRs — the workflow is workflow_call-only.
• Fix: use the runner's default $GITHUB_REF / $GITHUB_REF_NAME environment variables in the shell instead of expression interpolation, so the ref value is passed as data rather than expanded into the script text before the shell runs. No env: block changes needed — these are already provided automatically by the Actions runner.

Type of change

• Bug fix

Test plan

• Manual testing (describe below)

Validated the workflow YAML parses correctly (python3 -c "import yaml; yaml.safe_load(...)"). No Go code touched, so task test/task lint-fix don't apply; there's no repo lint step covering workflow YAML. Confirmed via grep that all shell-context github.ref/github.ref_name usages in this file are addressed, and that the remaining github.ref usages (in if: conditions and an action's with: input in the egress-proxy job) are pure Actions-expression contexts, not shell, so they're not part of this vulnerability class and were left untouched.

Does this introduce a user-facing change?

No.

Special notes for reviewers

• This fixes the 7 lines flagged in security review, plus 2 identical occurrences in the same file that weren't in the reporter's list (proxyrunner job's sign step, and the vmcp job's version-compute step) — same anti-pattern, same file, fixed for consistency rather than leaving a known-vulnerable twin in place.
• Severity on the advisory is being accepted as Medium rather than the filed High/8.8, since exploitation requires an account that already has push/release access to this repo (no fork/PR path reaches this workflow). That's a risk-based call on our threat model — this PR is the agreed-upon fix regardless of the severity discussion.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.71%. Comparing base (06940e8) to head (ca4022e).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6248   +/-   ##
=======================================
  Coverage   72.70%   72.71%           
=======================================
  Files         742      742           
  Lines       77273    77273           
=======================================
+ Hits        56184    56188    +4     
+ Misses      17131    17126    -5     
- Partials     3958     3959    +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.