Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Line 199: The echo command uses github.ref_name directly, which allows shell
metacharacters in branch/tag names to be executed; replace the interpolation
with the already-defined safe variable tag (used elsewhere) so the line uses
${tag} instead of ${{ github.ref_name }} when appending to
/tmp/release_notes.md; update the echo invocation that writes "**Full
Changelog**: https://github.com/${{ github.repository
}}/compare/${PREV_TAG}...${{ github.ref_name }}" to reference ${tag} and ensure
the variable names PREV_TAG and tag are quoted or safely expanded in that same
command.

In `@Cargo.toml`:
- Around line 104-110: The CI release job is still building wasm with the
generic --release flag so the new Cargo profile named profile.wasm-release is
never used; update the release build step that builds the wasm artifact to
invoke cargo with --profile wasm-release (instead of --release) when targeting
the wasm build (or add an additional cargo invocation using --profile
wasm-release for the wasm target), so the profile named profile.wasm-release is
exercised and its wasm-specific settings are applied.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In @.github/workflows/release.yml:
- Line 199: The echo command in the release job is interpolating the workflow
template variable `${{ github.ref_name }}` directly, which risks
template-expansion injection; replace that with the sanitized env vars already
available (use the runner-provided GITHUB_REPOSITORY and the existing tag env
var) and keep PREV_TAG as an env var reference so the line becomes safe — update
the echo that writes to /tmp/release_notes.md to use $GITHUB_REPOSITORY and $tag
(and $PREV_TAG) instead of `${{ github.ref_name }}`.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Line 199: The current echo appends a compare URL using PREV_TAG which produces
a broken link when PREV_TAG is empty; update the step that writes to
/tmp/release_notes.md to check PREV_TAG and choose a fallback URL when empty
(use the release page for the new tag, e.g.
https://github.com/${GITHUB_REPOSITORY}/releases/tag/${tag}) otherwise keep the
existing compare URL
(https://github.com/${GITHUB_REPOSITORY}/compare/${PREV_TAG}...${tag});
implement this conditional logic around the echo that references PREV_TAG and
tag so the generated link is valid in both cases.

---

Outside diff comments:
In @.github/workflows/release.yml:
- Around line 180-186: The script sets PRERELEASE_ARG to an empty string which
expands to an empty argv element when calling gh release create; instead make
PRERELEASE_ARG an array and set it to either an empty array or to an array
containing --prerelease depending on PRE_RELEASE_INPUT (e.g. PRERELEASE_ARG=()
vs PRERELEASE_ARG=(--prerelease)), then expand it as "${PRERELEASE_ARG[@]}" in
the gh release create invocation; update the if/else blocks that assign
PRERELEASE_ARG and ensure RELEASE_TYPE_NAME is preserved.