ci-poller-dispatch repository secrets

Trap: permissions: {} on .github/workflows/ci-poller-dispatch.yml looks sufficient because it removes GITHUB_TOKEN, but repository secrets remain injectable into caller-selected workflow YAML. Fix: the relay must never use repository secrets; use only production environment secrets after migrating values there, with the environment restricted to main. This preserves required workflow_dispatch recovery without letting an arbitrary ref expose privileged credentials.