ci: invoke ocio-env.sh through bash (no exec bit needed)

The script has no executable bit (git doesn't carry one reliably), so
the bare  invocation failed with 'Permission
denied' in the Linux act runs. Every call site now uses
OCIO_RS_ENABLE_REAL=1
OCIO_RS_LINK=static instead.

.github/workflows/cd.yml

@@ -109,7 +109,7 @@ jobs:
           # tooling/ocio-env.sh: vendored static OCIO everywhere it
           # builds (the [patch.crates-io] ocio-sys tracks shaloong/ocio-rs
           # main, whose vendored sources build on GCC >= 16).
-          tooling/ocio-env.sh >> "$GITHUB_ENV"
+          bash tooling/ocio-env.sh >> "$GITHUB_ENV"
 
       # TEMP: cache disabled until the Gitea instance cache is provisioned (Cache cargo artifacts)
       #   uses: Swatinem/rust-cache@v2
@@ -186,7 +186,7 @@ jobs:
           # noble) — do NOT apt-install them here.
 
       - name: Configure build environment
-        run: tooling/ocio-env.sh >> "$GITHUB_ENV"
+        run: bash tooling/ocio-env.sh >> "$GITHUB_ENV"
 
       # TEMP: cache disabled until the Gitea instance cache is provisioned (Cache cargo artifacts)
       #   uses: Swatinem/rust-cache@v2
@@ -247,7 +247,7 @@ jobs:
         run: |
           # Vendored static OCIO (same as every non-Windows platform via
           # tooling/ocio-env.sh); no OCIO_INSTALL_DIR override.
-          tooling/ocio-env.sh >> "$GITHUB_ENV"
+          bash tooling/ocio-env.sh >> "$GITHUB_ENV"
           {
             echo "CFLAGS=-I/opt/homebrew/include"
             echo "LDFLAGS=-L/opt/homebrew/lib"
@@ -364,7 +364,7 @@ jobs:
           # tooling/ocio-env.sh links it STATICALLY when the package ships
           # libOpenColorIO.a, dynamically otherwise (the DLL bundling step
           # below then still applies).
-          tooling/ocio-env.sh >> "$GITHUB_ENV"
+          bash tooling/ocio-env.sh >> "$GITHUB_ENV"
           # ocio-sys is the GIT fork (Mike-Solar/ocio-rs main, pinned in
           # the root manifest): its build.rs already carries the
           # fork's GNU-toolchain fix, so NO crate-unpack/glob patch step