fix(ci): target production from DFW runners

[mattmattox]

Completes TaskForge #20663 production deployment after the DFW migration exposed the old in-cluster kubeconfig assumption.

The Vault token is minted by the a1-ops-prd Kubernetes secrets engine, but kubernetes.default.svc and the projected CA now identify stackeye-ci-dfw01. This ports TaskForge’s tested cross-cluster action and configures KubeTTY-specific credentials.

• target the a1-ops-prd API endpoint directly with its reviewed CA
• keep keyless GitHub OIDC and a one-hour maximum Vault-minted ServiceAccount token
• assert the exact kubetty-ci-deployer identity before deployment
• prove denied access to kube-system secrets and a sibling production namespace
• clear the mint-capable Vault token before later steps

Validation:

• security helper tests: 21 passed
• KubeTTY deployer RBAC: target namespace yes; kube-system secrets no; beacon-prod deployments no
• embedded CA valid through 2035 and matches the established TaskForge DFW canary pattern
• TaskForge DFW cross-cluster canary run 31906219831 is green
• pre-push validation and git diff --check passed

Failure evidence: main run 33055562906 built/pushed successfully, then rejected the production token against the DFW in-cluster API.

TaskForge: #20663

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:3c372be825

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Check every dangerous verb before declaring isolation

If RBAC drift grants a different verb—such as list/watch on kube-system Secrets or create/delete on beacon-prod Deployments—these two get checks still return no, so the action reports verified isolation and deploys with a credential capable of exposing secrets or altering sibling production resources. Kubernetes authorizes RBAC verbs independently and explicitly warns that listing or watching Secrets reveals their contents; probe the relevant read and mutation verbs rather than treating one denied get as resource isolation.

Useful? React with 👍 / 👎.