ci(triage): escape triaging argument (#9977)

<!-- SECURITY https://linear.app/vercel/issue/VULN-897/prompt-injection-in-github-workflow-leaks-dollargh-token-supply-chain -->

Author: gr2m

.github/workflows/triage.yml

@@ -125,9 +125,11 @@ jobs:
             echo "No labels to apply"
           fi
 
-          echo "Reasoning: ${{ fromJSON(steps.classify-issue.outputs.json).reasoning }}"
+          # Use printf with environment variable to safely log reasoning and prevent command injection
+          printf 'Reasoning: %s\n' "$REASONING"
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REASONING: ${{ fromJSON(steps.classify-issue.outputs.json).reasoning }}
 
   triage_issue:
     name: Auto-triage Issue
@@ -247,6 +249,8 @@ jobs:
             echo "No labels to apply"
           fi
 
-          echo "Reasoning: ${{ fromJSON(steps.classify-issue.outputs.json).reasoning }}"
+          # Use printf with environment variable to safely log reasoning and prevent command injection
+          printf 'Reasoning: %s\n' "$REASONING"
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REASONING: ${{ fromJSON(steps.classify-issue.outputs.json).reasoning }}