Fixed CI injection risk and proved sealed bundle handoff end to end

[kridaydave]

PR made by union-alpha from opencode on behalf of Kriday.

The dogfood job interpolated `${{ github.head_ref }}) straight into a shell command, so a crafted branch name could run arbitrary code on the runner. The sealed-bundle test also stopped at encryption: nothing proved a maintainer could actually open the artifact.

Summary :

• Pass the branch name through an env var instead of shell interpolation
• Extend the separate-keyring seal test to the full handoff: sender cannot decrypt (NO_SECKEY), recipient decrypts with VALIDSIG against the sender fingerprint and DECRYPTION_OKAY
• Assert the received bundle matches the source HEAD, still holds the private .env blob, and carries a correct MANIFEST.json