ci: harden composite action inputs before shell use

[SashaMIT]

Summary

• CI hygiene for .github/actions/setup-node-if-needed, cache-svm-artifacts, and generate-svm-artifacts.
• Bind free-string inputs (node_version, type) under env: before run: script use (quoted $NODE_VERSION / $SVM_TYPE).
• with: / path: / key: expressions left as-is (not shell script text).
• Mirrors the existing CACHE_PATHS env binding in generate-svm-artifacts.
• Defense-in-depth for Actions composites — not framed as a vulnerability ticket.

Test plan

• Workflow YAML review
• Existing pr.yml / publish.yml SVM cache + generate paths still invoke the composites with type: artifacts / verified-test-binaries

Made with Cursor

[SashaMIT]

Superseded by #1512 for DCO — the previous tip (b1b3245) lacked Signed-off-by. Same change re-applied on ci/harden-composite-inputs-dco with a signed-off commit. Closing this PR in favor of #1512.

[SashaMIT]

Closing as superseded by #1512 (DCO Signed-off-by fix).