fix(ci): repair invalid refresh-vuln-db workflow (duplicate env key)

[Wolfvin]

Mengapa

refresh-vuln-db.yml gagal 0 detik di SETIAP push (254 run gagal, event: push) padahal on:-nya cuma schedule + workflow_dispatch. gh run view mengonfirmasi: "This run likely failed because of a workflow file issue" — nama run muncul sebagai path file, bukan name: field → GitHub gagal meng-compile.

Root cause: step "Push branch + create PR" punya dua key env: (satu GH_TOKEN, satu blok display vars). PyYAML diam-diam ambil yang terakhir (jadi yaml.safe_load lolos), tapi parser GitHub Actions menolak duplicate mapping key → file invalid → run gagal di tiap push.

Bonus: step "Create branch + commit" punya blok env: yang ke-indent 10 spasi sehingga ketelan ke dalam run: | (var commit message jadi kosong).

Perbaikan

• Merge dua blok env: di "Push branch + create PR" jadi satu (GH_TOKEN + 5 display vars).
• Naikkan blok env: "Create branch + commit" ke step-level (8 spasi) sebelum run:.

Verifikasi

Recursive duplicate-key check + schema parse: OK, no duplicate keys. Kedua step sekarang punya env proper (dikonfirmasi via yaml.safe_load).

Setelah merge: workflow file valid → tidak ada lagi push-noise; schedule bulanan + dispatch berfungsi.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud