ci: bind package-path workflow input before shell use

[SashaMIT]

Summary

Binds inputs.package-path into step env: before shell use in publish workflows when computing TARGET.

Context

GitHub Actions expands ${{ inputs.* }} before the shell runs. Binding through env: keeps the value out of the script text.

Test plan

• Confirm publish workflows still validate
• Next publish path still computes TARGET from package-path

Made with Cursor

[joncinque]

Thanks for your contribution! These workflows aren't susceptible to the injection attack, but it doesn't hurt to clean up