fix(deps): drop vergen-gix; fixes 7 gix-family CVEs + remove unused anstream

.github/workflows/cross-build.yml

@@ -59,14 +59,20 @@ jobs:
       - name: Pick tag
         id: pick
         shell: bash
+        # Indirect github-context into env: vars; semgrep run-shell-injection.
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_TAG: ${{ inputs.tag }}
+          REF_NAME: ${{ github.ref_name }}
         run: |
           set -euo pipefail
-          case "${{ github.event_name }}" in
+          case "$EVENT_NAME" in
             workflow_dispatch)
-              tag="${{ inputs.tag }}"
+              tag="$INPUT_TAG"
               ;;
             push)
-              tag="${{ github.ref_name }}"
+              tag="$REF_NAME"
               ;;
             workflow_run)
               # CI completed successfully. Pick the most recent v-tag — if
@@ -85,8 +91,6 @@ jobs:
           esac
           echo "Resolved tag: $tag"
           echo "tag=$tag" >> "$GITHUB_OUTPUT"
-        env:
-          GH_TOKEN: ${{ github.token }}
 
   build:
     name: ${{ matrix.os_arch }}

.github/workflows/package.yml

@@ -61,10 +61,14 @@ jobs:
       - name: Pick tag
         id: pick
         shell: bash
+        # Indirect via env: to keep untrusted github-context out of run:; semgrep
+        # run-shell-injection.
+        env:
+          INPUT_TAG: ${{ inputs.tag }}
         run: |
           set -euo pipefail
-          if [ -n "${{ inputs.tag }}" ]; then
-            tag="${{ inputs.tag }}"
+          if [ -n "$INPUT_TAG" ]; then
+            tag="$INPUT_TAG"
           else
             git fetch --tags --force origin
             tag=$(git tag --sort=-creatordate --list 'v*' | head -1)