MANUAL RUN: move the drop secrets into the drops environment #752

Right now DROPS_CLOUDFLARE_API_TOKEN and DROP_SECRET are repo secrets. An agent can edit desktop-drop.yml on its own branch and run it with workflow_dispatch, and the edited workflow gets both secrets. The PR from this work points the drop job at the drops environment, which already has you as required reviewer. The secrets still need to move into that environment, though.

In Settings → Environments → drops:

1. Add the secrets DROPS_CLOUDFLARE_API_TOKEN and DROP_SECRET as environment secrets, using the same values from 1Password.
2. Set Deployment branches and tags to Selected, and allow tags *-v* and branch main.
3. Back in Settings → Secrets and variables → Actions, delete both repo-level secrets.

Order doesn't matter relative to the PR: repo secrets stay visible to environment jobs until you delete them.

Done when gh api repos/QuinnsCode/RustyBuns/actions/secrets --jq '.secrets[].name' prints nothing and the next tag drop waits for your approval.