Security context

Highlights

Privilege Escalation: 2 prior fixes. Scrutinize any change in this area.

.github/workflows/pr-build.yml: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

Command Injection: String interpolation of unvalidated external inputs (such as version tags) directly into shell commands (like `./gradlew`) allowed arbitrary command execution within the runner context. Future workflows must pass user-controlled variables exclusively via environment variables.

Privilege Escalation: Default repository permissions allowed potentially dangerous write access within workflows. Restricting permissions explicitly to read-only mitigates risk if a runner or dependent action is compromised.

Privilege Escalation: Overly permissive default GITHUB_TOKEN scopes in the Master Build workflow presented a privilege escalation risk, requiring explicit blocks to enforce minimum necessary read privileges.