fix: safe JSON construction for Discord webhook notifications

[Copilot]

Discord webhook calls were silently failing whenever commit messages or author names contained ", \, or newlines — all common in the auto-increment workflow — because those values were interpolated raw into a hand-built JSON string.

Changes

• JSON construction — replaced manual string interpolation with jq -n --arg so all field values are properly escaped regardless of content
• Injection safety — COMMIT_MESSAGE and AUTHOR are now passed via env: instead of inline ${{ }} expressions in the shell script, avoiding both shell and JSON injection
• Failure visibility — changed curl -s → curl -sf so HTTP 4xx/5xx responses from Discord surface as step failures rather than silent no-ops

# Before — breaks on any " \ or newline in message
-d "{\"fields\": [{\"value\": \"${COMMIT_MESSAGE}\"}]}"

# After — jq handles all escaping
PAYLOAD=$(jq -n --arg message "$COMMIT_MESSAGE" '{embeds: [{fields: [{value: $message}]}]}')
curl -sf -X POST "$DISCORD_WEBHOOK" -H "Content-Type: application/json" -d "$PAYLOAD"