fix(ci): 服务端流水线注入加固(tag 校验/JSON 转义/workflow env)+ gitignore server/out

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013nMthbVEmQquxBRKb9Fj8u

.gitea/workflows/deploy-server.yml

@@ -32,9 +32,11 @@ jobs:
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
           FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
-        run: bash scripts/ci/release-server.sh "${{ gitea.ref_name }}"
+          TAG: ${{ gitea.ref_name }}
+        run: bash scripts/ci/release-server.sh "$TAG"
 
       - name: Deploy → pangolin1
         env:
           DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-        run: bash scripts/ci/deploy-server.sh "${{ gitea.ref_name }}"
+          TAG: ${{ gitea.ref_name }}
+        run: bash scripts/ci/deploy-server.sh "$TAG"