fix: pass commit message via env var in Actions template

[jpignata]

The GitHub Actions CI/CD template interpolated ${{ github.event.head_commit.message }} directly into a run: script:

run: openlayer push --message ${{ github.event.head_commit.message }} --api-key=${{ secrets.OPENLAYER_API_KEY }}

Commit messages can contain attacker-controlled text. Interpolating github.event.* values into shell scripts is a known Actions pitfall that enables script injection, since expression substitution happens before the shell parses the script.

This PR applies GitHub's recommended mitigation: pass the value through an intermediate environment variable so it's treated as shell data, never re-parsed as code. It also passes the API key via the OPENLAYER_API_KEY env var (which the CLI already reads) instead of the --api-key command-line flag, so the key no longer appears in the process list.

Ref: GitHub Actions security hardening — Using an intermediate environment variable