Writing arbitary env vars is dangerous

### TL;DR

The first example showing writing arbitrary tags from a PR description is a signficant security vulnerability, as it introduces a backdoor for arbitary code execution in CI/CD pipelines.

https://github.com/abcxyz/tagrep#github---exporting-tags-as-environment-variables

A maliciously crafted env var can allow an attacker to force code to run.

Things like NODE_OPTIONS, LD_PRELOAD, or PYTHONPATH could be used to load malicious code. Note the risk is somewhat decreased with proper human review before approving CI/CD runs, but there is a TOCTOU issue.

### Expected behavior

If env vars were prepended with a set prefix by default, most of this risk could be mitigated. There should be a more secure pattern demonstrated in the readme.

### Observed behavior

_No response_

### Environment Details

```markdown
N/A
```

### Additional information

_No response_

檢視 https://github.com/abcxyz/tagrep#github---exporting-tags-as-environment-variables 的 README 區段。了解工具目前如何將任意標籤匯出為環境變數。提出更安全的預設模式，例如為匯出的變數加上前綴（例如 TAGREP_）。更新文件，警告 NODE_OPTIONS、LD_PRELOAD 等帶來的風險，並建議採用安全模式。

由索引模型根據 Issue 內容生成。