Fix extract_version: inject commit msg via env (avoid backtick $() trap)

When github.event.head_commit.message contains shell metacharacters
(backticks, $(…), etc.) the literal-interpolation form spliced the
raw text into bash and triggered command substitution. Caught by the
keeb pipeline on Gitea — a commit message with backticks crashed
extract_version in 3 seconds and the whole fab graph cascade-skipped.

Pattern matches the upload-bom env: COMMIT_MESSAGE indirection used
further down the same file. Also routed github.sha the same way so
the fallback branch doesn't accidentally re-introduce the same class
of bug.

Mirror this verbatim into hfsdesign/kicad-ci on Gitea after pushing.

.gitea/workflows/kibot.yml

@@ -63,16 +63,24 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - id: derive
+        env:
+          # Inject via env so commit-message / PR-title backticks or
+          # other shell metacharacters don't trigger command substitution
+          # when bash evaluates the script. Direct ${{ … }} interpolation
+          # into the run: body would splice the raw text into bash —
+          # backticks become $(…). Keep this env-var indirection.
+          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          GIT_SHA: ${{ github.sha }}
         run: |
           # Dev branch: VERSION=dev. Main branch: parse VX.Y from commit
           # message (matches the GitLab-side rule). MR-to-main uses the
           # MR title's V-token, falling back to dev.
           if [ "${{ github.ref }}" = "refs/heads/main" ]; then
-            MSG="${{ github.event.head_commit.message }}"
-            VERSION=$(echo "$MSG" | grep -oE 'V[0-9]+(\.[0-9]+)*' | head -1 || true)
-            [ -z "$VERSION" ] && VERSION="${{ github.sha }}" && VERSION="${VERSION:0:8}"
+            VERSION=$(printf '%s' "$COMMIT_MESSAGE" | grep -oE 'V[0-9]+(\.[0-9]+)*' | head -1 || true)
+            [ -z "$VERSION" ] && VERSION="${GIT_SHA:0:8}"
           elif [ "${{ github.event_name }}" = "pull_request" ]; then
-            VERSION=$(echo "${{ github.event.pull_request.title }}" | grep -oE 'V[0-9]+(\.[0-9]+)*' | head -1 || true)
+            VERSION=$(printf '%s' "$PR_TITLE" | grep -oE 'V[0-9]+(\.[0-9]+)*' | head -1 || true)
             [ -z "$VERSION" ] && VERSION="dev"
           else
             VERSION="dev"