Close implicit loader and output alias gaps

Handle nested legacy substitutions, Git SSH configuration sinks, runtime stdin and awk evaluation, static Node preload options, makefile artifact sources, tainted archive extraction, and aliases of GitHub environment files. Add focused regressions and a matching GITHUB_ENV alias guard.

Author: VladimirBrejcha