Cross-Job Output Masking

### Problem

GHES secret masking blanks **all** activation job outputs when output values contain substrings matching registered secrets. Downstream jobs (agent, conclusion, detection, safe_outputs) receive empty strings for `needs.activation.outputs.*` references.

### Impact

- `artifact_prefix`**: Downstream jobs try to download `activation` instead of `-activation`, failing with "Artifact not found for name: activation".
- `target_repo` / `target_repo_name`**: The `Derive GitHub App owner` step fails with exit 1 because `GH_AW_TARGET_REPOSITORY` is empty. Additionally, `target_repo` is never defined as an activation job output — the compiler emits references to `needs.activation.outputs.target_repo` in downstream jobs but never adds it to the activation job's `outputs:` block.

### Current Workaround

- Each downstream job computes its own artifact prefix locally using `compute_artifact_prefix.sh` (step-level outputs within the same job bypass cross-job masking).
- Add `|| github.repository` fallback to `target_repo` and `|| github.event.repository.name` to `target_repo_name`.

### Suggested Fix

1. Compute `artifact_prefix` locally in each downstream job instead of passing it via cross-job outputs.
2. Define `target_repo` in the activation job's `outputs:` block, **and** compute it locally in downstream jobs to be resilient against GHES secret masking.
3. Add `|| github.repository` / `|| github.event.repository.name` fallbacks to all cross-job `target_repo` references as a defense-in-depth measure.