Prevent script injection in coverageReport workflow (#1295)

Move attacker-controlled PR body and derived step outputs from inline
${{ }} expressions to env variables, preventing shell command injection
via malicious PR descriptions (e.g. PR #1290).

Co-authored-by: Isaac

## Description
<!-- Provide a brief summary of the changes made and the issue they aim
to address.-->

## Testing
<!-- Describe how the changes have been tested-->

## Additional Notes to the Reviewer
<!-- Share any additional context or insights that may help the reviewer
understand the changes better. This could include challenges faced,
limitations, or compromises made during the development process.
Also, mention any areas of the code that you would like the reviewer to
focus on specifically. -->

NO_CHANGELOG=true (not a user facing change)

Author: madhav-db

.github/workflows/coverageReport.yml

@@ -38,8 +38,10 @@ jobs:
 
     - name: Check for coverage override
       id: override
+      env:
+        PR_BODY: ${{ github.event.pull_request.body }}
       run: |
-        OVERRIDE_COMMENT=$(echo "${{ github.event.pull_request.body }}" | grep -E "SKIP_COVERAGE_CHECK\s*=" || echo "")
+        OVERRIDE_COMMENT=$(echo "$PR_BODY" | grep -E "SKIP_COVERAGE_CHECK\s*=" || echo "")
         if [ -n "$OVERRIDE_COMMENT" ]; then
           echo "override=true" >> $GITHUB_OUTPUT
           REASON=$(echo "$OVERRIDE_COMMENT" | sed -E 's/.*SKIP_COVERAGE_CHECK\s*=\s*(.+)/\1/')
@@ -84,9 +86,12 @@ jobs:
         fi
         
     - name: Coverage enforcement summary
+      env:
+        OVERRIDE: ${{ steps.override.outputs.override }}
+        OVERRIDE_REASON: ${{ steps.override.outputs.reason }}
       run: |
-        if [ "${{ steps.override.outputs.override }}" == "true" ]; then
-          echo "⚠️ Coverage checks bypassed: ${{ steps.override.outputs.reason }}"
+        if [ "$OVERRIDE" == "true" ]; then
+          echo "⚠️ Coverage checks bypassed: $OVERRIDE_REASON"
           echo "Please ensure this override is justified and temporary"
         else
           echo "✅ Coverage checks enforced - minimum 85% required"