GitHub Actions untrusted contexts

Always treat GitHub event fields, dispatched refs, and selected workflow YAML as attacker-controlled. Chose default-branch workflow_run execution plus a production environment restricted to main over in-workflow ref guards because GitHub loads caller-selected YAML before any guard or checkout. A manual workflow_dispatch relay may remain only if it has permissions: {}, no repository secrets, and receives only production secrets protected from non-main refs. permissions: {} removes GITHUB_TOKEN, not ${{ secrets.* }}; secret-bearing jobs require protected-environment isolation and default-branch trusted execution.