diff --git a/.changeset/patch-drop-cache-name.md b/.changeset/patch-drop-cache-name.md
new file mode 100644
index 0000000000..b842451ecf
--- /dev/null
+++ b/.changeset/patch-drop-cache-name.md
@@ -0,0 +1,5 @@
+---
+"gh-aw": patch
+---
+
+Stop exposing the legacy `cache.name` override so cache steps stay in sync with the schema and auto-generated names, and align the related docs/engines text plus the Gemini execution step label.
diff --git a/.github/workflows/agent-persona-explorer.lock.yml b/.github/workflows/agent-persona-explorer.lock.yml
index aab8f83a87..be49edf6c4 100644
--- a/.github/workflows/agent-persona-explorer.lock.yml
+++ b/.github/workflows/agent-persona-explorer.lock.yml
@@ -1282,9 +1282,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/audit-workflows.lock.yml b/.github/workflows/audit-workflows.lock.yml
index a66c02ab6f..2f196b14fc 100644
--- a/.github/workflows/audit-workflows.lock.yml
+++ b/.github/workflows/audit-workflows.lock.yml
@@ -1520,9 +1520,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml
index 37d427a344..03342da4fe 100644
--- a/.github/workflows/ci-coach.lock.yml
+++ b/.github/workflows/ci-coach.lock.yml
@@ -1310,9 +1310,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/ci-doctor.lock.yml b/.github/workflows/ci-doctor.lock.yml
index 683e68c80b..52fb275c74 100644
--- a/.github/workflows/ci-doctor.lock.yml
+++ b/.github/workflows/ci-doctor.lock.yml
@@ -1455,9 +1455,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/claude-code-user-docs-review.lock.yml b/.github/workflows/claude-code-user-docs-review.lock.yml
index a49d9d962d..bdfeacd08e 100644
--- a/.github/workflows/claude-code-user-docs-review.lock.yml
+++ b/.github/workflows/claude-code-user-docs-review.lock.yml
@@ -1246,9 +1246,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/cli-version-checker.lock.yml b/.github/workflows/cli-version-checker.lock.yml
index 014849b251..79b467e566 100644
--- a/.github/workflows/cli-version-checker.lock.yml
+++ b/.github/workflows/cli-version-checker.lock.yml
@@ -1272,9 +1272,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml
index 1d6a7baa21..b9cd06b7e2 100644
--- a/.github/workflows/cloclo.lock.yml
+++ b/.github/workflows/cloclo.lock.yml
@@ -1669,9 +1669,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/code-scanning-fixer.lock.yml b/.github/workflows/code-scanning-fixer.lock.yml
index 1c90daf2b9..27a5d5be20 100644
--- a/.github/workflows/code-scanning-fixer.lock.yml
+++ b/.github/workflows/code-scanning-fixer.lock.yml
@@ -1445,9 +1445,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/copilot-agent-analysis.lock.yml b/.github/workflows/copilot-agent-analysis.lock.yml
index 16377953a9..775e9dde1c 100644
--- a/.github/workflows/copilot-agent-analysis.lock.yml
+++ b/.github/workflows/copilot-agent-analysis.lock.yml
@@ -1407,9 +1407,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/copilot-pr-nlp-analysis.lock.yml b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
index d61903d842..fd65dabf4f 100644
--- a/.github/workflows/copilot-pr-nlp-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
@@ -1401,9 +1401,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/copilot-pr-prompt-analysis.lock.yml b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
index 019e2e75ca..e6c447cabc 100644
--- a/.github/workflows/copilot-pr-prompt-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
@@ -1319,9 +1319,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/copilot-session-insights.lock.yml b/.github/workflows/copilot-session-insights.lock.yml
index 9d7a7ffdaf..dd7b8c87d9 100644
--- a/.github/workflows/copilot-session-insights.lock.yml
+++ b/.github/workflows/copilot-session-insights.lock.yml
@@ -1470,9 +1470,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/daily-code-metrics.lock.yml b/.github/workflows/daily-code-metrics.lock.yml
index 1d952868fa..4d62006d4b 100644
--- a/.github/workflows/daily-code-metrics.lock.yml
+++ b/.github/workflows/daily-code-metrics.lock.yml
@@ -1449,9 +1449,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/daily-compiler-quality.lock.yml b/.github/workflows/daily-compiler-quality.lock.yml
index d272f4520a..7f2574b64c 100644
--- a/.github/workflows/daily-compiler-quality.lock.yml
+++ b/.github/workflows/daily-compiler-quality.lock.yml
@@ -1216,9 +1216,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/daily-copilot-token-report.lock.yml b/.github/workflows/daily-copilot-token-report.lock.yml
index 5f899081e6..97a79d39d4 100644
--- a/.github/workflows/daily-copilot-token-report.lock.yml
+++ b/.github/workflows/daily-copilot-token-report.lock.yml
@@ -1417,9 +1417,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/daily-doc-updater.lock.yml b/.github/workflows/daily-doc-updater.lock.yml
index 66af741147..7c677d703c 100644
--- a/.github/workflows/daily-doc-updater.lock.yml
+++ b/.github/workflows/daily-doc-updater.lock.yml
@@ -1335,9 +1335,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/daily-firewall-report.lock.yml b/.github/workflows/daily-firewall-report.lock.yml
index 9379f58c36..bd55bd8989 100644
--- a/.github/workflows/daily-firewall-report.lock.yml
+++ b/.github/workflows/daily-firewall-report.lock.yml
@@ -1333,9 +1333,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/daily-issues-report.lock.yml b/.github/workflows/daily-issues-report.lock.yml
index 78dac71570..a634d6d2ec 100644
--- a/.github/workflows/daily-issues-report.lock.yml
+++ b/.github/workflows/daily-issues-report.lock.yml
@@ -1383,9 +1383,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
index a3de24891a..d99aa14cee 100644
--- a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
+++ b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
@@ -1288,9 +1288,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/daily-news.lock.yml b/.github/workflows/daily-news.lock.yml
index 5fafdcd3e2..4ebc525110 100644
--- a/.github/workflows/daily-news.lock.yml
+++ b/.github/workflows/daily-news.lock.yml
@@ -1479,9 +1479,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml
index 41e3d84da8..e9c0eb1f80 100644
--- a/.github/workflows/daily-performance-summary.lock.yml
+++ b/.github/workflows/daily-performance-summary.lock.yml
@@ -1818,9 +1818,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/daily-rendering-scripts-verifier.lock.yml b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
index 210c4f0929..0f7135af66 100644
--- a/.github/workflows/daily-rendering-scripts-verifier.lock.yml
+++ b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
@@ -1462,9 +1462,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/daily-repo-chronicle.lock.yml b/.github/workflows/daily-repo-chronicle.lock.yml
index 2a07de2bde..e9b0e1e370 100644
--- a/.github/workflows/daily-repo-chronicle.lock.yml
+++ b/.github/workflows/daily-repo-chronicle.lock.yml
@@ -1268,9 +1268,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/daily-safe-output-optimizer.lock.yml b/.github/workflows/daily-safe-output-optimizer.lock.yml
index 501cfcff53..97ad5eaa04 100644
--- a/.github/workflows/daily-safe-output-optimizer.lock.yml
+++ b/.github/workflows/daily-safe-output-optimizer.lock.yml
@@ -1402,9 +1402,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/deep-report.lock.yml b/.github/workflows/deep-report.lock.yml
index 71dec31854..9a9ea46d36 100644
--- a/.github/workflows/deep-report.lock.yml
+++ b/.github/workflows/deep-report.lock.yml
@@ -1522,9 +1522,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/developer-docs-consolidator.lock.yml b/.github/workflows/developer-docs-consolidator.lock.yml
index fc3dbb265c..19c44cb089 100644
--- a/.github/workflows/developer-docs-consolidator.lock.yml
+++ b/.github/workflows/developer-docs-consolidator.lock.yml
@@ -1415,9 +1415,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/firewall-escape.lock.yml b/.github/workflows/firewall-escape.lock.yml
index 7c261037e9..964dd02142 100644
--- a/.github/workflows/firewall-escape.lock.yml
+++ b/.github/workflows/firewall-escape.lock.yml
@@ -1379,9 +1379,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/github-mcp-structural-analysis.lock.yml b/.github/workflows/github-mcp-structural-analysis.lock.yml
index 3bd32249d0..8d8df1e73d 100644
--- a/.github/workflows/github-mcp-structural-analysis.lock.yml
+++ b/.github/workflows/github-mcp-structural-analysis.lock.yml
@@ -1325,9 +1325,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/github-mcp-tools-report.lock.yml b/.github/workflows/github-mcp-tools-report.lock.yml
index b2d8e27ee1..773a434fb8 100644
--- a/.github/workflows/github-mcp-tools-report.lock.yml
+++ b/.github/workflows/github-mcp-tools-report.lock.yml
@@ -1376,9 +1376,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml
index cde676ccc4..f045b299f9 100644
--- a/.github/workflows/glossary-maintainer.lock.yml
+++ b/.github/workflows/glossary-maintainer.lock.yml
@@ -1299,9 +1299,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/go-fan.lock.yml b/.github/workflows/go-fan.lock.yml
index 7defd6e238..e4f5fb35c8 100644
--- a/.github/workflows/go-fan.lock.yml
+++ b/.github/workflows/go-fan.lock.yml
@@ -1286,9 +1286,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/go-logger.lock.yml b/.github/workflows/go-logger.lock.yml
index ceef66ae4f..e37ecfd419 100644
--- a/.github/workflows/go-logger.lock.yml
+++ b/.github/workflows/go-logger.lock.yml
@@ -1499,9 +1499,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/gpclean.lock.yml b/.github/workflows/gpclean.lock.yml
index 7f5524450c..27d1a5fcf1 100644
--- a/.github/workflows/gpclean.lock.yml
+++ b/.github/workflows/gpclean.lock.yml
@@ -1199,9 +1199,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml
index 367c54e38c..ad7abc92ae 100644
--- a/.github/workflows/grumpy-reviewer.lock.yml
+++ b/.github/workflows/grumpy-reviewer.lock.yml
@@ -1339,9 +1339,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/instructions-janitor.lock.yml b/.github/workflows/instructions-janitor.lock.yml
index f70923bae0..fd30599d47 100644
--- a/.github/workflows/instructions-janitor.lock.yml
+++ b/.github/workflows/instructions-janitor.lock.yml
@@ -1327,9 +1327,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/jsweep.lock.yml b/.github/workflows/jsweep.lock.yml
index bf6548fc1e..b71422849a 100644
--- a/.github/workflows/jsweep.lock.yml
+++ b/.github/workflows/jsweep.lock.yml
@@ -1267,9 +1267,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/lockfile-stats.lock.yml b/.github/workflows/lockfile-stats.lock.yml
index e31e68c525..3010dc27b4 100644
--- a/.github/workflows/lockfile-stats.lock.yml
+++ b/.github/workflows/lockfile-stats.lock.yml
@@ -1245,9 +1245,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml
index 50b1123247..0130224ce0 100644
--- a/.github/workflows/mcp-inspector.lock.yml
+++ b/.github/workflows/mcp-inspector.lock.yml
@@ -1841,9 +1841,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/org-health-report.lock.yml b/.github/workflows/org-health-report.lock.yml
index ed33017753..e83bf79c36 100644
--- a/.github/workflows/org-health-report.lock.yml
+++ b/.github/workflows/org-health-report.lock.yml
@@ -1266,9 +1266,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml
index 9b971dba58..3c180c6fb7 100644
--- a/.github/workflows/pdf-summary.lock.yml
+++ b/.github/workflows/pdf-summary.lock.yml
@@ -1358,9 +1358,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/poem-bot.lock.yml b/.github/workflows/poem-bot.lock.yml
index d3b7b4af37..0981b86c3f 100644
--- a/.github/workflows/poem-bot.lock.yml
+++ b/.github/workflows/poem-bot.lock.yml
@@ -2043,9 +2043,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/portfolio-analyst.lock.yml b/.github/workflows/portfolio-analyst.lock.yml
index 02adc4484a..954f6129a5 100644
--- a/.github/workflows/portfolio-analyst.lock.yml
+++ b/.github/workflows/portfolio-analyst.lock.yml
@@ -1344,9 +1344,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/pr-nitpick-reviewer.lock.yml b/.github/workflows/pr-nitpick-reviewer.lock.yml
index 9682c84b9d..6fbf1a5378 100644
--- a/.github/workflows/pr-nitpick-reviewer.lock.yml
+++ b/.github/workflows/pr-nitpick-reviewer.lock.yml
@@ -1440,9 +1440,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/prompt-clustering-analysis.lock.yml b/.github/workflows/prompt-clustering-analysis.lock.yml
index 3736c635fe..7a99ccdd4a 100644
--- a/.github/workflows/prompt-clustering-analysis.lock.yml
+++ b/.github/workflows/prompt-clustering-analysis.lock.yml
@@ -1376,9 +1376,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/python-data-charts.lock.yml b/.github/workflows/python-data-charts.lock.yml
index 833173fb70..01561a98f3 100644
--- a/.github/workflows/python-data-charts.lock.yml
+++ b/.github/workflows/python-data-charts.lock.yml
@@ -1329,9 +1329,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml
index 8fa7c6bb07..1d3176f75c 100644
--- a/.github/workflows/q.lock.yml
+++ b/.github/workflows/q.lock.yml
@@ -1512,9 +1512,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/repo-audit-analyzer.lock.yml b/.github/workflows/repo-audit-analyzer.lock.yml
index e8ef7e8c0a..2e5e8f7a1c 100644
--- a/.github/workflows/repo-audit-analyzer.lock.yml
+++ b/.github/workflows/repo-audit-analyzer.lock.yml
@@ -1200,9 +1200,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory-repo-audits" ] && [ "$(ls -A /tmp/gh-aw/cache-memory-repo-audits 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (repo-audits)
         if: steps.check_cache_repo_audits.outputs.has_content == 'true'
diff --git a/.github/workflows/repository-quality-improver.lock.yml b/.github/workflows/repository-quality-improver.lock.yml
index e8cd937eb7..4d5d08c7da 100644
--- a/.github/workflows/repository-quality-improver.lock.yml
+++ b/.github/workflows/repository-quality-improver.lock.yml
@@ -1198,9 +1198,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory-focus-areas" ] && [ "$(ls -A /tmp/gh-aw/cache-memory-focus-areas 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (focus-areas)
         if: steps.check_cache_focus_areas.outputs.has_content == 'true'
diff --git a/.github/workflows/safe-output-health.lock.yml b/.github/workflows/safe-output-health.lock.yml
index 2713e36443..400dff2f36 100644
--- a/.github/workflows/safe-output-health.lock.yml
+++ b/.github/workflows/safe-output-health.lock.yml
@@ -1338,9 +1338,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/schema-consistency-checker.lock.yml b/.github/workflows/schema-consistency-checker.lock.yml
index 52cafd6d6b..7df0feb460 100644
--- a/.github/workflows/schema-consistency-checker.lock.yml
+++ b/.github/workflows/schema-consistency-checker.lock.yml
@@ -1246,9 +1246,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml
index 22eb34fe5f..566b124afa 100644
--- a/.github/workflows/scout.lock.yml
+++ b/.github/workflows/scout.lock.yml
@@ -1458,9 +1458,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/security-review.lock.yml b/.github/workflows/security-review.lock.yml
index 5b457f015f..e788e2c1ee 100644
--- a/.github/workflows/security-review.lock.yml
+++ b/.github/workflows/security-review.lock.yml
@@ -1410,9 +1410,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/sergo.lock.yml b/.github/workflows/sergo.lock.yml
index 294e37e87a..6c5ba497ba 100644
--- a/.github/workflows/sergo.lock.yml
+++ b/.github/workflows/sergo.lock.yml
@@ -1285,9 +1285,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml
index 30062d078b..7967f8ede7 100644
--- a/.github/workflows/slide-deck-maintainer.lock.yml
+++ b/.github/workflows/slide-deck-maintainer.lock.yml
@@ -1367,9 +1367,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
index b1c3afcf06..0bd8d980de 100644
--- a/.github/workflows/smoke-claude.lock.yml
+++ b/.github/workflows/smoke-claude.lock.yml
@@ -2916,9 +2916,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml
index 5d3c2aa0b6..9fa2182b38 100644
--- a/.github/workflows/smoke-codex.lock.yml
+++ b/.github/workflows/smoke-codex.lock.yml
@@ -1771,9 +1771,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/smoke-copilot-arm.lock.yml b/.github/workflows/smoke-copilot-arm.lock.yml
index c6716c42a4..7bb53e772e 100644
--- a/.github/workflows/smoke-copilot-arm.lock.yml
+++ b/.github/workflows/smoke-copilot-arm.lock.yml
@@ -2335,9 +2335,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index d930e307e8..37509b476f 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -2337,9 +2337,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/smoke-gemini.lock.yml b/.github/workflows/smoke-gemini.lock.yml
index 00fab79ebb..f275937074 100644
--- a/.github/workflows/smoke-gemini.lock.yml
+++ b/.github/workflows/smoke-gemini.lock.yml
@@ -1413,9 +1413,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/stale-repo-identifier.lock.yml b/.github/workflows/stale-repo-identifier.lock.yml
index 195944d6bb..9661b9f3c0 100644
--- a/.github/workflows/stale-repo-identifier.lock.yml
+++ b/.github/workflows/stale-repo-identifier.lock.yml
@@ -1333,9 +1333,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/static-analysis-report.lock.yml b/.github/workflows/static-analysis-report.lock.yml
index f9bc3230a0..659ee707d0 100644
--- a/.github/workflows/static-analysis-report.lock.yml
+++ b/.github/workflows/static-analysis-report.lock.yml
@@ -1320,9 +1320,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/step-name-alignment.lock.yml b/.github/workflows/step-name-alignment.lock.yml
index 2b111ec56c..9093288479 100644
--- a/.github/workflows/step-name-alignment.lock.yml
+++ b/.github/workflows/step-name-alignment.lock.yml
@@ -1271,9 +1271,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/super-linter.lock.yml b/.github/workflows/super-linter.lock.yml
index c61bdf4430..979e0fb617 100644
--- a/.github/workflows/super-linter.lock.yml
+++ b/.github/workflows/super-linter.lock.yml
@@ -1260,9 +1260,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml
index b3d4a93bb5..1bf444a50b 100644
--- a/.github/workflows/technical-doc-writer.lock.yml
+++ b/.github/workflows/technical-doc-writer.lock.yml
@@ -1383,9 +1383,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/test-create-pr-error-handling.lock.yml b/.github/workflows/test-create-pr-error-handling.lock.yml
index c8bb7f1a51..3beb62351d 100644
--- a/.github/workflows/test-create-pr-error-handling.lock.yml
+++ b/.github/workflows/test-create-pr-error-handling.lock.yml
@@ -1301,9 +1301,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml
index 8ed102734e..ef55d3f761 100644
--- a/.github/workflows/unbloat-docs.lock.yml
+++ b/.github/workflows/unbloat-docs.lock.yml
@@ -1596,9 +1596,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/.github/workflows/weekly-issue-summary.lock.yml b/.github/workflows/weekly-issue-summary.lock.yml
index ff439895a7..fc0b1b0c73 100644
--- a/.github/workflows/weekly-issue-summary.lock.yml
+++ b/.github/workflows/weekly-issue-summary.lock.yml
@@ -1242,9 +1242,9 @@ jobs:
         shell: bash
         run: |
           if [ -d "/tmp/gh-aw/cache-memory" ] && [ "$(ls -A /tmp/gh-aw/cache-memory 2>/dev/null)" ]; then
-            echo "has_content=true" >> $GITHUB_OUTPUT
+            echo "has_content=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_content=false" >> $GITHUB_OUTPUT
+            echo "has_content=false" >> "$GITHUB_OUTPUT"
           fi
       - name: Save cache-memory to cache (default)
         if: steps.check_cache_default.outputs.has_content == 'true'
diff --git a/actions/setup/js/mcp_server_core.test.cjs b/actions/setup/js/mcp_server_core.test.cjs
index fd8ca15445..821fa38580 100644
--- a/actions/setup/js/mcp_server_core.test.cjs
+++ b/actions/setup/js/mcp_server_core.test.cjs
@@ -734,7 +734,7 @@ process.stdin.on('end', () => {
         `#!/bin/bash
 echo "Hello from shell script"
 echo "Input was: $INPUT_NAME"
-echo "result=success" >> $GITHUB_OUTPUT
+echo "result=success" >> "$GITHUB_OUTPUT"
 `,
         { mode: 0o755 }
       );
@@ -785,8 +785,7 @@ echo "result=success" >> $GITHUB_OUTPUT
   echo "first=value1"
   echo "second=value2"
   echo "third=value with spaces"
-} >> $GITHUB_OUTPUT
-`,
+} >> "$GITHUB_OUTPUT"`,
         { mode: 0o755 }
       );
 
@@ -873,7 +872,7 @@ exit 1
         handlerPath,
         `#!/bin/bash
 echo "my-input value: $INPUT_MY_INPUT"
-echo "result=$INPUT_MY_INPUT" >> $GITHUB_OUTPUT
+echo "result=$INPUT_MY_INPUT" >> "$GITHUB_OUTPUT"
 `,
         { mode: 0o755 }
       );
diff --git a/actions/setup/js/safe_inputs_mcp_server.test.cjs b/actions/setup/js/safe_inputs_mcp_server.test.cjs
index 5e2f5c0b65..953987b14b 100644
--- a/actions/setup/js/safe_inputs_mcp_server.test.cjs
+++ b/actions/setup/js/safe_inputs_mcp_server.test.cjs
@@ -166,7 +166,7 @@ process.stdin.on('end', () => {
         handlerPath,
         `#!/bin/bash
 echo "Shell says: $INPUT_NAME"
-echo "greeting=Hello from shell" >> $GITHUB_OUTPUT
+echo "greeting=Hello from shell" >> "$GITHUB_OUTPUT"
 `,
         { mode: 0o755 }
       );
@@ -748,7 +748,7 @@ process.stdin.on('end', () => {
         echoShPath,
         `#!/bin/bash
 echo "Shell echo: $INPUT_MESSAGE"
-echo "result=Shell echo: $INPUT_MESSAGE" >> $GITHUB_OUTPUT
+echo "result=Shell echo: $INPUT_MESSAGE" >> "$GITHUB_OUTPUT"
 `,
         { mode: 0o755 }
       );
diff --git a/actions/setup/sh/start_mcp_gateway.sh b/actions/setup/sh/start_mcp_gateway.sh
index c60bc632c3..b9ab5753f9 100755
--- a/actions/setup/sh/start_mcp_gateway.sh
+++ b/actions/setup/sh/start_mcp_gateway.sh
@@ -431,4 +431,4 @@ echo ""
   echo "gateway-pid=$GATEWAY_PID"
   echo "gateway-port=${MCP_GATEWAY_PORT}"
   echo "gateway-api-key=${MCP_GATEWAY_API_KEY@Q}"
-} >> $GITHUB_OUTPUT
+} >> "$GITHUB_OUTPUT"
diff --git a/pkg/workflow/cache.go b/pkg/workflow/cache.go
index fe8b5f2dd6..ddc5d88bcd 100644
--- a/pkg/workflow/cache.go
+++ b/pkg/workflow/cache.go
@@ -736,9 +736,9 @@ func (c *Compiler) buildUpdateCacheMemoryJob(data *WorkflowData, threatDetection
 		checkStep.WriteString("        shell: bash\n")
 		checkStep.WriteString("        run: |\n")
 		fmt.Fprintf(&checkStep, "          if [ -d \"%s\" ] && [ \"$(ls -A %s 2>/dev/null)\" ]; then\n", cacheDir, cacheDir)
-		checkStep.WriteString("            echo \"has_content=true\" >> $GITHUB_OUTPUT\n")
+		checkStep.WriteString("            echo \"has_content=true\" >> \"$GITHUB_OUTPUT\"\n")
 		checkStep.WriteString("          else\n")
-		checkStep.WriteString("            echo \"has_content=false\" >> $GITHUB_OUTPUT\n")
+		checkStep.WriteString("            echo \"has_content=false\" >> \"$GITHUB_OUTPUT\"\n")
 		checkStep.WriteString("          fi\n")
 		steps = append(steps, checkStep.String())