Resolves a zizmor/template-injection code scanning alert by removing direct GitHub expression expansion inside a run: bash script, which could allow shell injection if output values contain metacharacters.

Changes:

• In the "Verify Java 21 outputs are set" step, moved ${{ steps.setup-java-21.outputs.path }} and ${{ steps.setup-java-21.outputs.version }} from inline script expansion into env: variables (JAVA_21_PATH, JAVA_21_VERSION), consistent with the safe pattern used throughout the rest of the workflow.

# Before (unsafe)
run: |
  if [ -z "${{ steps.setup-java-21.outputs.path }}" ]; then ...

# After (safe)
env:
  JAVA_21_PATH: ${{ steps.setup-java-21.outputs.path }}
  JAVA_21_VERSION: ${{ steps.setup-java-21.outputs.version }}
run: |
  if [ -z "$JAVA_21_PATH" ]; then ...

Related issue:
N/A — code scanning alert #122

Check list:

• Ran npm run check locally (format, lint, build, test) and all checks pass.
• Mark if documentation changes are required.
• Mark if tests were added or updated to cover the changes.