ci: scope HK broker credentials to generation step

[Pigbibi]

Summary

• remove LongBridge credentials from the publish job environment
• inject GitHub-hosted credentials only into the factor generation step and only for LongBridge plus github_secrets mode
• pin all third-party actions in the publish workflow to full commit SHAs
• document the narrowed secret boundary in English and Chinese
• add workflow security contract tests

Validation

• 6 targeted workflow tests passed
• workflow checked with actionlint 1.7.12
• Ruff and git diff --check passed

Safety

No live permission, broker execution, publish default, strategy logic, or order path is changed. Secret Manager remains the default credential mode.