fix: prevent command injection in deploy workflow commit message

The commit message was being directly interpolated into bash script,
causing words like 'dfx' and 'to' to be interpreted as commands.

Solution: Use GitHub Actions env block to safely pass commit message
as environment variable, which properly escapes special characters.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: domwoe

.github/workflows/deploy.yml

@@ -86,6 +86,8 @@ jobs:
 
         - name: Determine deployment mode
           id: deploy-mode
+          env:
+            COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
           run: |
             # Determine deployment mode with multiple strategies:
             # 1. Manual workflow dispatch - use selected mode
@@ -97,10 +99,8 @@ jobs:
               MODE="${{ github.event.inputs.deploy_mode }}"
               echo "✅ Using manual deployment mode: $MODE"
             elif [ "${{ github.event_name }}" = "push" ]; then
-              # Check for commit message override
-              COMMIT_MSG="${{ github.event.head_commit.message }}"
-
-              if echo "$COMMIT_MSG" | grep -qi '\[frontend-only\]'; then
+              # Check for commit message override (using env var for safe handling)
+              if echo "$COMMIT_MESSAGE" | grep -qi '\[frontend-only\]'; then
                 MODE="frontend-only"
                 echo "🏷️  Commit message tag [frontend-only] detected → frontend-only deployment"
               else