fix(ci): prevent shell expansion of publish tag

[paullegranddc]

Motivation

• Prevent command-injection via Git tag names in the publish workflow which could trigger shell command substitution and potentially exfiltrate the CRATES_IO_TOKEN secret.

Description

• Update .github/workflows/publish.yaml to store steps.tag.outputs.tag in an environment variable PUBLISH_TAG and pass it to ./scripts/publish-crate.sh as "${PUBLISH_TAG}" instead of interpolating the GitHub expression directly in the run block.

Testing

• No automated tests were run for this minimal workflow-only change; the edit is limited to .github/workflows/publish.yaml and does not change runtime release logic.

---

Codex Task

[datadog-prod-us1-5]

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: bf19269 | Docs | Datadog PR Page | Give us feedback!}