fix: security hardening — GHA injection, wrong constant, invalid JSON

- .github/workflows/release.yml: Fix script injection by moving
  user-controlled inputs (module_path, tag_suffix) to env vars instead
  of direct ${{ }} interpolation in shell blocks. Pin
  softprops/action-gh-release to SHA (v2.6.2). Add explicit
  permissions: contents: read to the detect job.

- collection/ai_surface/ai_surface.c: Replace INVALID_FILE_ATTRIBUTES
  with the correct (DWORD)0xFFFFFFFF for GetFileSize error check.
  Both happen to be 0xFFFFFFFF but the former is semantically wrong.

- discovery/wallpaper_enum/metadata.json: Remove trailing comma that
  made the file invalid JSON.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.github/workflows/release.yml

@@ -21,6 +21,8 @@ on:
 jobs:
   detect:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       matrix: ${{ steps.build_matrix.outputs.matrix }}
       has_changes: ${{ steps.build_matrix.outputs.has_changes }}
@@ -33,11 +35,13 @@ jobs:
       - name: Build module matrix
         id: build_matrix
         shell: bash
+        env:
+          INPUT_MODULE_PATH: ${{ github.event.inputs.module_path }}
         run: |
           set -euo pipefail
 
           if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-            MODULE_PATH="${{ github.event.inputs.module_path }}"
+            MODULE_PATH="${INPUT_MODULE_PATH}"
             
             if [[ ! -d "${MODULE_PATH}" ]]; then
               echo "Error: Module path '${MODULE_PATH}' does not exist" >&2
@@ -234,6 +238,8 @@ jobs:
       - name: Create release tag
         id: tag
         shell: bash
+        env:
+          INPUT_TAG_SUFFIX: ${{ github.event.inputs.tag_suffix }}
         run: |
           set -euo pipefail
 
@@ -249,8 +255,8 @@ jobs:
           TS="$(date -u +"%Y-%m-%d-%H%M%S")"
           SHORT="${HEAD_SHA:0:7}"
           
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" && -n "${{ github.event.inputs.tag_suffix }}" ]]; then
-            TAG="${SANITIZED_DIR}-${{ github.event.inputs.tag_suffix }}"
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" && -n "${INPUT_TAG_SUFFIX}" ]]; then
+            TAG="${SANITIZED_DIR}-${INPUT_TAG_SUFFIX}"
           else
             TAG="${SANITIZED_DIR}-${TS}-${SHORT}"
           fi
@@ -259,7 +265,7 @@ jobs:
           echo "Created tag: ${TAG}"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           tag_name: ${{ steps.tag.outputs.tag }}
           name: Release ${{ steps.tag.outputs.tag }}

collection/ai_surface/ai_surface.c

@@ -404,7 +404,7 @@ static int read_file_text_bounded(LPCWSTR path, DWORD max_bytes, char **out_buf,
     }
 
     fileSize = KERNEL32$GetFileSize(hFile, NULL);
-    if (fileSize == INVALID_FILE_ATTRIBUTES) {
+    if (fileSize == (DWORD)0xFFFFFFFF) {
         KERNEL32$CloseHandle(hFile);
         return 0;
     }

discovery/wallpaper_enum/metadata.json

@@ -1,5 +1,5 @@
 {
   "projectName": "wallpaper_enum",
   "category": "recon",
-  "summary": "Enumerates per-monitor desktop wallpaper paths via the IDesktopWallpaper COM API to reveal centrally hosted images or network shares.",
+  "summary": "Enumerates per-monitor desktop wallpaper paths via the IDesktopWallpaper COM API to reveal centrally hosted images or network shares."
 }