fix(ci): pass major-tag input through env instead of shell interpolation

[cvscarlos]

Summary

Hardens ci.update-major-version-tag.yaml by reading the resolved tag from the step's env: instead of expanding ${{ ... }} inside the run: script.

This follows GitHub's recommendation for inline scripts: https://docs.github.com/en/actions/reference/security/secure-use#use-an-intermediate-environment-variable

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved issues were identified.

Review effort: Lite
Findings: None

What changed in this PR

Hardens the CI workflow by passing the resolved major tag through an environment variable instead of shell interpolation.

Changes:

• Adds TAG_NAME to the step environment.
• Preserves existing validation and tag-update behavior.

File	Description
.github/​workflows/​ci.update-major-version-tag.yaml	Uses an environment variable for safer tag handling.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[kpplis]

@cvscarlos did you test this by pointing your target workflow to this branch and running it? We need to confirm it's not braking things before merging.