Issue Description

Apply ConvertTo-GitHubActionsEscaped from CIHelpers module to infrastructure and tooling scripts that emit workflow commands. This prevents workflow command injection when user-controlled data appears in CI output.

Files to update:

• .github/workflows/dependency-pinning-scan.yml
• scripts/dev-tools/Generate-PrReference.ps1
• scripts/extension/Package-Extension.ps1
• scripts/extension/Prepare-Extension.ps1
• scripts/lib/Get-VerifiedDownload.ps1

Additional Context

Related to PR #354 which introduced the CIHelpers module with escape functions. These files span workflow definitions, extension packaging, PR tooling, and the verified download library.