[tefkah]

Moves every deploy off the org secrets SSH_PRIVATE_KEY, SSH_USER, SSH_HOST_PREVIEW/PROD, GHCR_USER and GHCR_TOKEN, and off the servers' own age keys, onto the KF console's deploy-secrets route (kf-console #81).

• kf.project.jsonc: production (tags/v*, infra/.env.enc) and sandbox (heads/main, infra/.env.sandbox.enc), each deployed elsewhere by deploy-stack.yml.
• Previews. They use sandbox's values and are deployed only by main's own workflows (the schedule, or a dispatch of reset-preview-envs on main), never by a pull request's run. The console refuses pull_request runs, and an environment owns its ref, so sandbox and previews (both on main) are one environment. A preview runs the PR's code with those values, so they must be disposable. on_pr loses deploy-preview (already off) and close-preview; reset-preview-envs now prunes the stacks of closed or unlabeled PRs. .env.preview.enc is no longer read.
• deploy-stack.yml: takes environment and runs its job in that GitHub Environment, with the only OIDC token in these workflows. It runs kf ci ssh-agent and pipes kf ci secrets --runtime over ssh. No GitHub secret but GITHUB_TOKEN, which also does the image pull. Inputs are checked before they reach the server's command line. Actions pinned by SHA.
• infra/deploy-remote.sh (on the server, was the heredoc): reads the values into memory and hands them to docker stack deploy as its environment. Which services get which keys is a compose file of names only, generated and given on stdin before the stack file, so the stack file's own environment: still wins, as it did over env_file. Nothing is written to disk, and the old .env.<stack> is deleted. Caddy now gets only PUBSTAR_HOSTNAME and Postgres only its three, not the whole file. On a failed rollout it no longer prints service inspect --pretty, which shows the values.
• Callers: on_tag and deploy-manual (production, on a tag, the tag's own image) and on_main_2, deploy-manual and reset-preview-envs (sandbox, on main). deploy-manual says up front when it is dispatched on a ref the console would refuse. No workflow has id-token: write at the top any more.

Checked: actionlint (only the existing if: false note, plus existing shellcheck notes in steps this doesn't touch), shellcheck, biome ci, kf check from #81's CLI (manifest valid), and docker stack config on the generated file plus stack.yml and stack.preview.yml with fake values. A dry run of the server script with stubbed sudo, git and docker covered production and sandbox, the refused names, and a bad prune list. Not run against a real console or server.

Merge only after the console's deploy-secrets route is in production and this repo's environments are set up in the console. (kf-console #81 merged and deployed, kf 0.7.0 published.)