security: mask HK broker credentials in Actions

[Pigbibi]

Summary

• register LongBridge staging credentials with the GitHub Actions masker immediately after credential resolution
• cover both Secret Manager and GitHub Secrets modes without changing credential values or execution flow
• add a regression test requiring masking before the snapshot generator runs

Validation

• rtk pytest tests/test_publish_hk_snapshot_artifacts_workflow.py
• git diff --check

This does not deploy, invoke Cloud Run, or change any scheduler/runtime target.