fix: drop setup-node uses; fix GITHUB_OUTPUT python quoting

Remove the optional setup-node step (still 404s as ##[error] on this
forge). Fix review.sh output writer — escaped quotes in a one-liner
caused SyntaxError after an otherwise successful publish.

action.yml

@@ -48,21 +48,14 @@ outputs:
 runs:
   using: composite
   steps:
-    # Gitea forges often lack an actions/setup-node mirror (clone → 404).
-    # Prefer runner-provided Node; only call setup-node when the mirror exists.
-    - name: Setup Node (optional mirror)
-      id: setup_node
-      continue-on-error: true
-      uses: actions/setup-node@v4
-      with:
-        node-version: "20"
-
+    # Do not uses: actions/setup-node — many Gitea forges have no mirror (404).
+    # Runner image / consumer workflow must provide Node >= 18.
     - name: Require Node.js
       shell: bash
       run: |
         if ! command -v node >/dev/null 2>&1; then
           echo "::error::Node.js >= 18 required for Gatekeep (merge-findings.js / publish.js)."
-          echo "Mirror actions/setup-node on this forge, preinstall Node on the runner, or add setup-node before uses: ./."
+          echo "Preinstall Node on the runner, or add a mirrored setup-node step before uses: ./."
           exit 1
         fi
         node --version

scripts/review.sh

@@ -176,11 +176,14 @@ set -e
 
 META=$(cat "$OUT/merge-meta.json")
 if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
-  python3 -c 'import json,os,sys
+  python3 - "$META" <<'PY'
+import json, os, sys
 m = json.loads(sys.argv[1])
-open(os.environ["GITHUB_OUTPUT"],"a").write(
-  f"risk_tier={m[\"risk_tier\"]}\nsecurity_blocking={str(m[\"security_blocking\"]).lower()}\nagreed_count={m[\"agreed_count\"]}\n"
-)' "$META"
+with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as fh:
+    fh.write(f"risk_tier={m['risk_tier']}\n")
+    fh.write(f"security_blocking={str(m['security_blocking']).lower()}\n")
+    fh.write(f"agreed_count={m['agreed_count']}\n")
+PY
 fi
 
 exit "$pub_ec"