GITHUB_ENV BASH_ENV Injection

A script or build backend that runs early in a GitHub Actions job appends BASH_ENV=<attacker script> to $GITHUB_ENV, so bash sources the attacker script before every later run step, including the publish step that holds the registry token.