v1.0.0

fix: resolve injection vectors and add input validation

- Pass mode input via env block instead of direct ${{ }} interpolation
- Validate assert-count is a positive integer before use in URL
- Use stdin-piped urlencode helper to avoid env name coupling