fix(ci): pass workflow_run head_branch through env; read-only tokens

auto-merge.yml interpolated ${{ github.event.workflow_run.head_branch }} straight into a run script that holds a contents:write token. A fork pull request controls that branch name, so it could run commands with write access (CodeQL actions/code-injection/critical). It now arrives as an environment variable.

ci.yml, code-quality.yml and deploy.yml get permissions: contents: read; none of them writes through GITHUB_TOKEN.

.github/workflows/auto-merge.yml

@@ -18,8 +18,10 @@ jobs:
       - name: Find and merge master → main PR
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Through the environment, never interpolated into the script: a fork's
+          # branch name is attacker-chosen and would run with this job's write token.
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
         run: |
-          HEAD_BRANCH="${{ github.event.workflow_run.head_branch }}"
           echo "Workflow ran on branch: $HEAD_BRANCH"
 
           if [ "$HEAD_BRANCH" != "master" ]; then