Add secrets migration workflow

[kivra-carhar]

Summary

This PR adds a workflow to migrate secrets from org/repo level to the prod environment.

Secrets to Migrate

• HEX_API_KEY

Discovered in Workflows

• ci.yml: HEX_API_KEY

How to Use

Pre-requisite: Create the environment

Before running the workflow, ensure the prod environment exists:

gh api --method PUT repos/OWNER/REPO/environments/prod

Or via the GitHub UI: Settings → Environments → New environment → name it prod

Steps

1. Merge this PR
2. Create the environment (if not already done)
3. Go to Actions → Migrate Secrets to Environment → Run workflow
4. Select the target environment (default: prod)
5. Click Run workflow
6. Verify the migration succeeded (check the workflow summary)
7. Update your workflows to remove secrets: inherit
8. Delete the migration workflow file

Why?

We're moving from org-level secrets to environment-level secrets for better security:

• Scoped access: Environment secrets are only available to jobs using that environment
• Branch protection: The prod environment only allows deployments from protected branches
• Reduced blast radius: If a secret is exposed, it only affects one environment

---

Generated by migrate_secrets tool