chore: avoid shell interpolation of tag name in npm-publish job

Pass github.ref_name to npm/publish.js via an environment variable
instead of interpolating it into the run script, so a crafted tag name
cannot inject shell commands.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NaL51TwfZAAEEWU2v5CNWT

Author: alnr

.github/workflows/ci.yaml

@@ -94,9 +94,10 @@ jobs:
           node-version: "22"
       - env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN_AENEASR }}
+          REF_NAME: ${{ github.ref_name }}
         run: |
           echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
-          node npm/publish.js ${{ github.ref_name }}
+          node npm/publish.js "$REF_NAME"
 
   newsletter-draft:
     name: Draft newsletter