ci: harden cross-repo build workflow against workflow injection

[wangchen-vivo]

Fixes the command-injection RCE reported in vivoblueos/kernel#458, where attacker-controlled PR content was interpolated into execSync shell strings and could execute arbitrary commands in CI.

Changes

• Command injection: run format/license/check commands via execFileSync argument arrays instead of execSync string concatenation, so filenames/repo names are never interpreted by a shell (poc$(id).rs no longer expands).
• Fail-closed checks: a format tool that fails to run (file missing, parse error, tool crash) now fails the job instead of being skipped and reported as "All modified files pass format check".
• Least privilege: format, license, and build jobs run with permissions: {} and a placeholder github-token: unused, so injected code cannot obtain the job's GITHUB_TOKEN. Container GHCR login credentials and packages: read were removed because the image is public.
• Tokenless sync: the old setup job is split into resolve_prs, which keeps a token to comment and resolve PRs, and apply_prs, which runs repo init, sync, merge, and upload without one. This way repo sync has no GITHUB_TOKEN, so a <repo-hooks> hook injected via an attacker-controlled manifests PR cannot execute untrusted code.
• Input validation: build_prs links must belong to this org; PR metadata is passed to shell steps via env rather than ${{ }} interpolation into run:, so a value containing shell metacharacters is treated as data and never evaluated as commands.
• Resource limits: concurrency is grouped per PR, so a new build_prs comment cancels the in-progress run instead of launching another set of matrix build jobs.

[github-actions]

Job is started, see https://github.com/vivoblueos/kernel/actions/runs/32966137588.

[github-actions]

❌ Job failed. Failed jobs: check_format (failure), build_and_check_boards (failure), see https://github.com/vivoblueos/kernel/actions/runs/32966137588.

[wangchen-vivo]

build_prs

[github-actions]

Job is started, see https://github.com/vivoblueos/kernel/actions/runs/32968279881.

[github-actions]

❌ Job failed. Failed jobs: build_and_check_boards (failure), see https://github.com/vivoblueos/kernel/actions/runs/32968279881.

[wangchen-vivo]

build_prs

[github-actions]

Job is started, see https://github.com/vivoblueos/kernel/actions/runs/32977874406.

[github-actions]

❌ Job failed. Failed jobs: build_and_check_boards (failure), see https://github.com/vivoblueos/kernel/actions/runs/32977874406.

[wangchen-vivo]

build_prs

[github-actions]

Job is started, see https://github.com/vivoblueos/kernel/actions/runs/33030126518.

[github-actions]

❌ Job failed. Failed jobs: build_and_check_boards (failure), see https://github.com/vivoblueos/kernel/actions/runs/33030126518.

[wangchen-vivo]

build_prs

[github-actions]

Job is started, see https://github.com/vivoblueos/kernel/actions/runs/33033612990.

[github-actions]

✅ All jobs completed successfully, see https://github.com/vivoblueos/kernel/actions/runs/33033612990.