ci: bind GPG keyid via env before shell in release-publish

Per review: keyid comes from crazy-max/ghaction-import-gpg parsing a
repo-owned secret, so practical risk is low; bind it anyway so every
run: block in the release path follows the same env-first pattern and
the invariant does not depend on that action's output staying trusted.

Made-with: Cursor
Signed-off-by: SashaMIT <sash.t.mitchell@gmail.com>

Author: SashaMIT

.github/workflows/release-publish.yml

@@ -35,7 +35,9 @@ jobs:
           trust_level: 5
 
       - name: Set default GPG key
-        run: echo "default-key ${{ steps.gpg.outputs.keyid }}" >> ~/.gnupg/gpg.conf
+        env:
+          GPG_KEYID: ${{ steps.gpg.outputs.keyid }}
+        run: echo "default-key $GPG_KEYID" >> ~/.gnupg/gpg.conf
 
       - name: Sign release
         run: tools/build-release.sh --without-zip sign