Complete template injection security fix - all tests passing

All vulnerable patterns eliminated and verified:
- 0 DEFAULT_BRANCH direct assignments remain
- 0 github.repository in run blocks remain
- 62 workflows use REPO_NAME env variable
- 17 workflows use DEFAULT_BRANCH env variable
- All unit tests pass
- Code formatted and linted

Co-authored-by: pelikhan <[email protected]>

Author: Copilot

pkg/workflow/.github/aw/actions-lock.json

@@ -11,4 +11,4 @@
       "sha": "2028fbc5c25fe9cf00d9f06a71cc4710d4507903"
     }
   }
-}
+}