security: harden execute-release.yml per zizmor

- Route AutoVer release tag/name through env vars in the GitHub release step
  (avoids template-injection via ${{ steps.* }} in a run block).
- Suppress artipacked on Checkout: persist-credentials must stay true so the
  deploy-key git config survives for the version/changelog push.

Author: GarrettBeatty

.github/workflows/execute-release.yml

@@ -58,7 +58,7 @@ jobs:
           secret-ids: |
             DEPLOY_KEY, prod/devops/aws-dotnet-ai-deploy-key
       # Full clone of the trunk using the deploy key.
-      - name: Checkout
+      - name: Checkout # zizmor: ignore[artipacked] persist-credentials must stay true for the deploy-key push
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
         with:
           ref: main
@@ -146,8 +146,10 @@ jobs:
         if: steps.freeze.outputs.frozen == 'false'
         env:
           GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.relmeta.outputs.tag }}
+          RELEASE_NAME: ${{ steps.relmeta.outputs.name }}
         run: |
-          gh release create "${{ steps.relmeta.outputs.tag }}" \
-            --title "${{ steps.relmeta.outputs.name }}" \
+          gh release create "$RELEASE_TAG" \
+            --title "$RELEASE_NAME" \
             --notes-file "$RUNNER_TEMP/release_notes.md" \
             --target "$(git rev-parse HEAD)"