ci: sync execution-evidence ingress token

[Pigbibi]

Summary

• pass the optional, dedicated EXECUTION_EVIDENCE_SYNC_TOKEN from the protected deployment environment to the Worker
• write it with Wrangler only when the secret is configured; its value is never logged

Safety boundary

• this adds no evidence collector, platform credential, strategy change, runtime-target change, or order path
• without the separately configured secret, the Worker remains fail-closed for execution-evidence writes

Validation

• git diff --check
• node --check --input-type=module < web/strategy-switch-console/worker.js
• generated Worker assets regenerated and confirmed clean