fix(ci): validate patch-release version input

[BunsDev]

Motivation

• The patch-release workflow accepted an arbitrary workflow_dispatch version string and interpolated it directly into run scripts, enabling command-substitution injection that can read GH_TOKEN and tamper with release assets.

Description

• Added a workflow-level PATCH_RELEASE_VERSION env var and a preflight validation step that enforces the tag regex ^v[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.-]+)?$ in .github/workflows/patch-release.yml before any privileged operations run.
• Replaced all direct "${{ inputs.version }}" interpolation inside run: blocks with the quoted environment variable $PATCH_RELEASE_VERSION to avoid GitHub Actions expression pre-interpolation into the shell.
• Moved patch_note usage into an environment variable (PATCH_RELEASE_NOTE) for the summary block and left inputs.patch_note only where it is safe for non-shell use (action inputs/env).
• Changes are limited to .github/workflows/patch-release.yml and preserve existing functionality while removing the command-injection surface.

Testing

• Ran git diff --check with no whitespace or syntax issues and committed the change. (passed)
• Parsed the modified YAML with Ruby to ensure it remains valid YAML. (passed)
• Executed local bash validation tests that accept valid tags (v1.2.3, v1.2.3-rc.1) and reject payloads that include command-substitution such as v0.1.0$(touch /tmp/coven-injected). (passed)
• Ran a Python scan to confirm there is no remaining direct inputs.version or inputs.patch_note interpolation inside run blocks. (passed)

---

Codex Task

[Copilot]

Pull request overview

This PR hardens the patch-release GitHub Actions workflow against command-substitution injection by validating the user-supplied tag and ensuring the tag/note are not interpolated directly into shell scripts.

Changes:

• Introduces a workflow-level PATCH_RELEASE_VERSION env var and validates it early against a SemVer-like tag regex before running privileged steps.
• Replaces direct ${{ inputs.version }} usage inside run: blocks with quoted $PATCH_RELEASE_VERSION.
• Moves patch_note use in the summary step into an env var (PATCH_RELEASE_NOTE) to avoid expression interpolation inside the summary shell.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.