fix(ci): repair broken submit-packages workflow YAML

Previous semgrep-fix commit (600defe) on this workflow merged the
shell-script body into the env: block and left a second env: block
behind, so the YAML didn't parse and every push triggered an
auto-failing "workflow file issue" run.

- Collapse the duplicated env: blocks into one (VERSION/PMS/DRY_RUN
  plus GITHUB_TOKEN/AUR_SSH_KEY/GPG_PRIVATE_KEY/GPG_PASSPHRASE)
- Add the missing `run: |` separator before the shell script

Verified with `python3 -c "yaml.safe_load(...)"`; all four release
workflows (submit-packages, desktop-release, mobile-release,
npm-publish) parse clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ralyodio

.github/workflows/submit-packages.yml

@@ -106,7 +106,11 @@ jobs:
           VERSION: ${{ steps.version.outputs.version }}
           PMS: ${{ steps.pms.outputs.package_managers }}
           DRY_RUN: ${{ github.event.inputs.dry_run }}
-
+          GITHUB_TOKEN: ${{ secrets.PKG_SUBMIT_TOKEN || secrets.GITHUB_TOKEN }}
+          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+        run: |
           ARGS="-v $VERSION"
 
           for PM in $(echo "$PMS" | tr ',' ' '); do
@@ -119,11 +123,6 @@ jobs:
 
           echo "Running: npx tsx scripts/submit-packages.ts $ARGS"
           npx tsx scripts/submit-packages.ts $ARGS
-        env:
-          GITHUB_TOKEN: ${{ secrets.PKG_SUBMIT_TOKEN || secrets.GITHUB_TOKEN }}
-          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
-          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
       - name: Summary
         if: always()