🔒 Security Auto-Fix: CodeQL Alerts

[xaostech-security]

Automated Security Fixes

This PR contains automatic fixes for security alerts detected by CodeQL.

Alerts Addressed:

• [ERROR] actions/untrusted-checkout/high: .github/workflows/automerge.yml:266
• [ERROR] actions/untrusted-checkout/high: .github/workflows/automerge.yml:235
• [WARNING] actions/code-injection/medium: .github/workflows/validate-pr.yml:75
• [WARNING] actions/code-injection/medium: .github/workflows/validate-pr.yml:74
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:145
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:144
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:142
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:141
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:140
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:139
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:138
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:137
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:136
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:143
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:143
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:113
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:106
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:102
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:108
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:101
• [WARNING] actions/code-injection/medium: .github/workflows/central-loader.yml:103
• [WARNING] actions/unpinned-tag: .github/workflows/central-loader.yml:234
• [WARNING] actions/unpinned-tag: .github/workflows/test.yml:47
• [WARNING] actions/unpinned-tag: .github/workflows/bash-lint-advanced.yml:173
• [ERROR] actions/untrusted-checkout/high: .github/workflows/automerge.yml:135

Changes Made:

• Extract GitHub Actions context variables to environment variables
• Pin unpinned third-party actions to commit SHAs
• Quote shell variables to prevent code injection

Verification Needed:
Review required - validate that fixes don't break workflow functionality

---

Auto-generated by security-autofix workflow