Use github.sha instead of env.GITHUB_SHA in deploy workflow

The env context in GitHub Actions expressions only exposes variables
explicitly defined via env: keys in the workflow YAML. It does not
expose runner-injected variables such as GITHUB_SHA.

As a result, the commit parameter passed to
dawidd6/action-download-artifact was an empty string, causing the
action to silently fall back to the artifact from the latest available
commit. This happened to resolve correctly in practice, but relied on
implicit fallback behavior that is not guaranteed.

Replace with ${{ github.sha }}, which is the correct and explicit way
to reference the triggering commit SHA in an expression context.

.github/workflows/deploy.yml

@@ -66,7 +66,7 @@ jobs:
         uses: dawidd6/action-download-artifact@v20
         with:
           workflow: oxipng.yml
-          commit: ${{ env.GITHUB_SHA }}
+          commit: ${{ github.sha }}
           name: Oxipng binary (${{ matrix.target }})
           path: target