ci: prevent script injection in commit lint

[zhongkechen]

Summary

• move pull request values out of the generated shell script and into step environment variables
• use immutable base and head commit SHAs for the lint range
• quote both environment variables when constructing the range argument

This remediates the reported GitHub Actions script injection finding in .github/workflows/ci.yml.

Validation

• git diff --check
• parsed .github/workflows/ci.yml with Ruby YAML
• confirmed no github.event expression remains directly embedded in a run: command