Add secrets migration workflow

[kivra-carhar]

Summary

This PR adds a workflow to migrate secrets from org/repo level to the prod environment.

Secrets to Migrate

• HEX_API_KEY

Discovered in Workflows

• ci.yml: HEX_API_KEY

How to Use

1. Merge this PR
2. Go to Actions → Migrate Secrets to Environment → Run workflow
3. Select the target environment (default: prod)
4. Click Run workflow
5. Verify the migration succeeded (check the workflow summary)
6. Update your workflows to remove secrets: inherit
7. Delete the migration workflow file

Why?

We're moving from org-level secrets to environment-level secrets for better security:

• Scoped access: Environment secrets are only available to jobs using that environment
• Branch protection: The prod environment only allows deployments from protected branches
• Reduced blast radius: If a secret is exposed, it only affects one environment

---

Generated by migrate_secrets tool