Escape feature-file text in generated code, harden CI

[menjoo]

Findings from a security review of the repository and its settings. Two are defects in this
codebase; the rest are CI and repository configuration.

Generated code

FeatureTestGenerator embedded two values from a .feature file as raw code rather than through
KotlinPoet's %S: a pickle's tags and a doc string's media type, both built by hand as "$it".
Every other embedded value in that file already used %S, so this was an oversight.

Both are attacker-controlled. A tag may contain anything except whitespace, and ${...} needs
none, so @a${Runtime.getRuntime()} became a live template in the consumer's test source. A media
type is unconstrained text after the fence, so a quote closed the literal outright. Either way a
.feature file — data, reviewed as prose — became code compiled and run by ./gradlew build.

Mutation-tested: reverting either sink fails exactly the tests written for it.

The KDoc test is a guard, not a fix. A scenario name is echoed into the function's KDoc where a
bare */ would end the block early; KotlinPoet already escapes the * to *, and the test
pins that down so a version bump cannot quietly remove it.

Release workflow

inputs.version was interpolated into four run blocks. The template engine substitutes before
bash parses, so the surrounding quotes were not a defence — and the first sink sat inside the step
that validates the version, so the validation could not constrain its own input. A dispatcher with
write access could have read the signing key, which write access does not otherwise grant. It goes
through the environment now.

The job moves into a release environment, so the publishing credentials sit behind a deployment
approval instead of at repository scope where any workflow on any branch could read them.

Actions and permissions

Every action is pinned to a commit SHA. android-actions/setup-android was the one that mattered:
a mutable v3 tag in the only job holding the signing key and the Central Portal credentials. The
rest are pinned for consistency, since the repository now requires SHA pinning.

CI and upstream-drift declare contents: read. Both ran with a write token because the repository
default was write, and CI runs ./gradlew build — arbitrary build-script code from the branch
under test.

Applied outside this diff

• Repository default GITHUB_TOKEN set to read
• SHA pinning required for actions
• Dependabot alerts and automated security fixes enabled
• release environment created, required reviewer, protected branches only
• The four publishing secrets moved to environment scope; repository copies deleted
• required_status_checks added to the main ruleset for the Tier A and example jobs. The browser
  job is deliberately excluded, per the comment in ci.yml about not letting a Karma flake block
  the gate.

Verification

:cucumber-kmp-gradle-plugin:test, :cucumber-kmp-core:jvmTest, :cucumber-kmp-ksp:test and
examples/calculator jvmTest (real end-to-end feature generation) all pass locally.

This is also the first pull request to run through the newly required status checks.