fix: pass workflow context via env instead of interpolating into run

[ivanasabi]

Summary

Security audit followed up on unit-typescript-sdk.yml (hardening / informational): the Detect fork PR step interpolated github.event.pull_request.head.repo.full_name (plus github.event_name / github.repository) directly into a run: block. There is no practical injection path today (repo/owner naming rules constrain these values), but the interpolation pattern is still worth removing.

       - name: Detect fork PR
         id: fork-check
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          HEAD_REPO_FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }}
+          REPOSITORY: ${{ github.repository }}
         run: |
-          if [[ "${{ github.event_name }}" == "pull_request" && \
-                "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]]; then
+          if [[ "$EVENT_NAME" == "pull_request" && \
+                "$HEAD_REPO_FULL_NAME" != "$REPOSITORY" ]]; then

Actions-by-SHA pinning (also flagged as hardening) is intentionally out of scope here — it touches every workflow in the repo and is best done in a dedicated pass.

Evidence

$ python3 -c "import yaml; yaml.safe_load(open('.github/workflows/unit-typescript-sdk.yml'))" && echo OK
OK

No behavior change: same fork-check logic, same fork- prefix output.

Merge Danger

Door: two-way (revert the commit)

Blast Radius: CI-only

[github-actions]

Python Preview Packages — Publish Failed

Preview publish failed for commit 3e6ca94.
See the workflow run for details.