63ab3ec57e
Use environment variables instead of direct ${{ inputs.version }}
interpolation in shell scripts to prevent script injection.
Switch from sed to jq for updating manifest.json, consistent
with how release.yml already reads the version.