Fix template injection (zizmor alert #119) in e2e-versions.yml

[Copilot]

Resolves a zizmor/template-injection code scanning alert: ${{ steps.setup-java-21.outputs.path }} and ${{ steps.setup-java-21.outputs.version }} were interpolated directly inside a run: shell block, allowing step outputs containing shell metacharacters to inject arbitrary commands.

Fix: Move template expressions out of the script body and into the step's env: section, then reference them as plain shell variables — the same pattern used by the adjacent step (alert #118 fix).

# Before (vulnerable)
- name: Verify Java 21 outputs are setrun: | echo "Java 21 path=${{ steps.setup-java-21.outputs.path }}" if [ -z "${{ steps.setup-java-21.outputs.path }}" ]; then ...# After (safe)
- name: Verify Java 21 outputs are setenv:
JAVA_21_PATH: ${{ steps.setup-java-21.outputs.path }}JAVA_21_VERSION: ${{ steps.setup-java-21.outputs.version }}run: | echo "Java 21 path=$JAVA_21_PATH" if [ -z "$JAVA_21_PATH" ]; then ...

Related issue:
N/A

Check list:

• Ran npm run check locally (format, lint, build, test) and all checks pass.
• Mark if documentation changes are required.
• Mark if tests were added or updated to cover the changes.