Composite actions substitute ${{ inputs.* }} directly into the run:
script source before execution, and the runner echoes that resolved
script at the top of the step log. Interpolating private_key and
transfers straight into the heredocs meant the raw SSH private key
was printed in plaintext on every run. Move both through env: and
reference them as shell variables instead, matching ssh-checkout and
ssh-command.
