fix(ci): move runner.temp job-env to step level — graph dispatch killer

bootstrap-installer.yml declared job-level env with ${{ runner.temp }},
which GitHub only allows at step level. Any ci.yaml dispatch validated
the whole reusable-workflow graph incl. this callee and failed with
0 jobs (invisible silent failure — no jobs, no logs). Our merge wired
this lane into ci.yaml, surfacing the latent bug. Actionlint flagged it;
moved INSTALL_DIR/HERMES_HOME/HERMES_RUNTIME_DIR to the steps that use
them.

.github/workflows/bootstrap-installer.yml

@@ -26,10 +26,9 @@ jobs:
     name: install.sh sandbox install + stamp verification
     runs-on: ubuntu-24.04
     timeout-minutes: 15
-    env:
-      INSTALL_DIR: ${{ runner.temp }}/bootstrap-install
-      HERMES_HOME: ${{ runner.temp }}/hermes-home
-      HERMES_RUNTIME_DIR: ${{ runner.temp }}/hermes-tools
+    # NOTE: `runner.temp` is only available in step-level env, not job-level
+    # env — a job-env `${{ runner.temp }}` makes GitHub reject the workflow
+    # graph at dispatch (0 jobs). Each step that needs these exports them.
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -68,6 +67,9 @@ jobs:
       - name: Run the installer stages against the PR checkout
         shell: bash
         env:
+          INSTALL_DIR: ${{ runner.temp }}/bootstrap-install
+          HERMES_HOME: ${{ runner.temp }}/hermes-home
+          HERMES_RUNTIME_DIR: ${{ runner.temp }}/hermes-tools
           HERMES_REPO_URL: ${{ steps.source.outputs.mirror }}
         run: |
           set -euo pipefail
@@ -91,6 +93,8 @@ jobs:
 
       - name: Verify the shipped version stamp
         shell: bash
+        env:
+          INSTALL_DIR: ${{ runner.temp }}/bootstrap-install
         run: |
           python3 scripts/verify-bootstrap-version-stamp.py \
             --stamp "$INSTALL_DIR/.hermes-bootstrap-complete" \
@@ -100,6 +104,8 @@ jobs:
 
       - name: The pinned commit is on the branch the installer cloned
         shell: bash
+        env:
+          INSTALL_DIR: ${{ runner.temp }}/bootstrap-install
         run: |
           # The stamp must describe the bytes actually checked out: the
           # installed repo's HEAD is exactly the commit the installer pinned.