Fix expression injection vulnerability where fork-controlled step outputs
(compareSha, benchmarkTarget) are interpolated directly into a run: block
via ${{ }} syntax, allowing shell command injection.

Changes:

1. Wrap step outputs in environment variables (same pattern as COMMENT_BODY)
2. Add SHA format validation for compareSha before use

References:

• GitHub Security Lab: Keeping your GitHub Actions and workflows secure
• OWASP CI/CD-SEC-4: Poisoned Pipeline Execution