security(workflows): harden credential persistence and env interpolation against template injection

Author: hateem2121

.github/workflows/e2e.yml

@@ -110,8 +110,12 @@ jobs:
       - name: 🧹 Cleanup Neon Preview Branch
         if: always() && steps.create_neon_branch.outputs.branch_id != ''
         continue-on-error: true
+        env:
+          NEON_PROJECT_ID: ${{ secrets.NEON_PROJECT_ID }}
+          BRANCH_ID: ${{ steps.create_neon_branch.outputs.branch_id }}
+          NEON_API_KEY: ${{ secrets.NEON_API_KEY }}
         run: |
           curl -s -X DELETE \
-            "https://console.neon.tech/api/v2/projects/${{ secrets.NEON_PROJECT_ID }}/branches/${{ steps.create_neon_branch.outputs.branch_id }}" \
-            -H "Authorization: Bearer ${{ secrets.NEON_API_KEY }}" \
+            "https://console.neon.tech/api/v2/projects/${NEON_PROJECT_ID}/branches/${BRANCH_ID}" \
+            -H "Authorization: Bearer ${NEON_API_KEY}" \
             -H "Accept: application/json"

.github/workflows/wiki-sync.yml

@@ -21,13 +21,16 @@ jobs:
     steps:
       - name: Checkout main repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Checkout wiki repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: RUN-APPAREL/RUN.wiki
           path: wiki
           token: ${{ secrets.GITHUB_TOKEN }}
+          persist-credentials: true
 
       - name: Sync wiki source files
         run: |