CI 中的 Secrets：工作流与基础设施
通过 OIDC 将 CI 作业绑定到云角色，禁止在日志和工件中使用长期有效的 PAT，锁定机密到受保护的环境，并将派生请求与生产凭据隔离。
Defines zero-downtime secret rotation by publishing a new secret under a key identifier, dual-accepting old and new material during a measured grace window, and revoking the old secret only after observed coverage.