fix(ci): repair invalid contribution_approved workflow + harden untrusted inputs

[Jose-Gael-Cruz-Lopez]

Problem

contribution_approved.yml was an invalid workflow file and startup-failed on every event (visible as a string of failed push runs going back to commits before this work). The cause is on the "Comment on failure" step:

body: '... Error details: ${{ steps.process.outputs.error_message || steps.update_readme.outputs.error_message || "Unknown error" }}'

GitHub Actions expressions only allow single-quoted string literals; the double-quoted "Unknown error" is a syntax error that invalidates the whole file. Because the file never loaded, the manual contribution approval path never ran (the "Just Paste Link" flow uses the separate, healthy auto_extract.yml, so only manual New Hackathon / Close Hackathon → approved submissions were affected).

Fix

1. Repair the syntax error — move error_message into env: and default to 'Unknown error' in JS. This also removes the script-injection into the github-script body flagged in [Critical] Security: GitHub Actions command & script injection via untrusted issue content #41.
2. Harden the other injection sinks (they go live the moment the workflow starts running again): commit_message, contributor_name, and contributor_email now flow through env: and are referenced as quoted shell vars instead of ${{ }} interpolation into run:.
3. No-op commit guard — an empty diff no longer fails the run and posts a spurious "error processing your contribution" comment.
4. Least-privilege permissions: block added (contents: write, issues: write) — the file previously had none and fell back to the default token scopes.

Verification

• YAML parses; no double-quoted literal remains inside any ${{ }}.
• Pushing this branch produced no contribution_approved startup-failure for the commit, whereas prior branch pushes (with the broken file) did — confirming GitHub now accepts the file.

Out of scope (tracked in #41)

auto_extract.yml has the analogous commit_message injection on its own commit step. It's left untouched here to avoid risk to the primary, currently-working add-hackathon flow; it should get the same env: treatment as a follow-up.

Refs #41

🤖 Generated with Claude Code