ci: keep resource-writer credentials ephemeral

[Jeremy1844]

Root cause

The two automated resource-writer paths construct a Git remote containing the write credential. That can expose the value through process/config diagnostics and leave it in repository metadata; one path also retained checkout credentials.

Change

• disable checkout credential persistence for the asset writer
• use a credential-free GitHub remote in both writers
• provide the step-scoped credential through a temporary local helper that stores only an environment-variable reference
• remove the helper and its local Git configuration unconditionally through an EXIT trap
• add a two-workflow regression guard

This draft addresses only ADV-2026-0057 / RC-0057. TLS policy remains the separate #78 root; dispatch validation, action provenance/permissions, token scope/rotation, and deployment atomicity are unchanged.

Evidence

• base: stage@9d237dd4fb37dd1fb936e3f9649020cc43a374c8
• regression: 05658679a440710283520b4f6cfbeceadaaf9185 — 0/2 introduced cases pass
• fixed head/tree: 4d20fea900801bc315eadd717df2f2c4370210c2 / ec74e48894b050186c81b342fa3fd87263c7c9db — 2/2 pass
• both workflow documents parse with exact js-yaml 4.1.0; both decoded write scripts pass bash -n
• a synthetic fake-credential harness proves the value is absent from Git arguments, remotes, configuration calls, and output; it also proves helper set/unset and removal on exit
• git diff --check and added-secret-pattern checks pass
• exact scope is three text files, +80/-2; src, assets, ops, package.json, and yarn.lock Git objects are unchanged

No workflow/deployment credential was resolved, printed, captured, or used, and no authenticated stage/production fetch or push was attempted.

Open-PR composition

• fix: make resource validation read-only and fail closed #76: path-disjoint; exact pair tree a28b334c396af71736266d6058f233aa7dec0ce5
• ci: fix resource workflow path filters #77: shares only deploy-assets.yml; exact pair tree fb7b6c37af532d691cda5df04bfad6e8678d4d87, with 5/5 combined cases passing
• ci: enforce TLS for authenticated resource writes #78: shares both writer workflows but changes the independent TLS decision; exact pair tree 4fe586802f55beb612aa02e9861f3f62a4b4abce, with 4/4 combined cases passing
• ci: remove unused changed-file workflow boundary #79: path-disjoint; exact pair tree 166a07b44083a4598abaed01b3309fed33a27a04
• all four open drafts plus this branch converge in both tested orders on tree c09e14c215fab1705546e807bbbb1676522299e4; the materialized composition passes 15/15 focused cases, all eight YAML parses, diff checks, and the synthetic no-secret harness

These remain independent root causes and should remain separate pull requests.

Rollout, recovery, and remaining gates

There is no user-data, schema, content, package, lockfile, or artifact migration. On authentication failure, pause automated writing, preserve the source/base SHA and generated output, and use a reviewed recovery path; do not restore a credential-bearing remote.

Before merge, maintainers should run a no-content synthetic fetch/push in an authorized staging repository with redacted process/config/remote/log capture, confirm least scope and short lifetime (preferably GitHub App issuance), privately review retained history and rotate/restrict credentials if warranted, validate the exact composition on hosted runners, and land #78 independently. No lesson, translation, image, audio, video, PDF, Ellen G. White material, or other rights-controlled content changes.