ci: harden GitHub Actions token and input handling (#2008)