ci: protect remaining workflow JSON env headers with reusable secrets

[Pigbibi]

Summary

Extend #608's reusable-workflow secret boundary to the remaining six workflow paths: Runtime Guard, the main Execution Report Heartbeat job, Deploy Cloud Run, Env Sync Drift Check, Notify Route Check, and both Collect Reconciliation Evidence jobs.

• Keep the existing vars-first / legacy-secret fallback in non-executing caller jobs; pass the original JSON through explicitly declared workflow-call secrets before any executing runner's env header.
• Move executing jobs unchanged apart from the JSON env expressions. Preserve entry-point names, triggers, schedules, dispatch defaults, conditions, matrices, dependencies, cloud identities, permissions, and caller-only concurrency. Leave ci(digest): stop printing target JSON variables in public producer/emit logs #608's existing digest path intact.
• Point the drift-check script's extraction constant at the moved deployment implementation, with a regression for default/explicit extraction equivalence.
• Add offline structural/mutation regressions for workflow/job/step env exposure, secret/input pass-through, both reconciliation consumers, and the existing digest boundary. Adapt existing workflow contract tests to caller/callee separation. Correct the shell contract's stale GITHUB_SHA expectation to the baseline's already-existing SOURCE_COMMIT behavior.

Validation

• Full local suite: 1305 passed, 5 skipped (synthetic/local tests only).
• Ruff; actionlint 1.7.12 across all workflows (shellcheck/pyflakes integrations disabled); shell workflow contract; Cloud Run startup validator; dependency-lock check; QPK pin consistency; git diff --check: passed.
• Parsed baseline comparison: all extracted job definitions match main 15b5fd5 except the two intended JSON env expressions; entry-point trigger/default/concurrency definitions and cloud env identity values match.
• Independent review: no blocking findings; 39 focused checks passed.

Scope and limitations

This protects the original JSON values in runner step env headers. It does not guarantee masking of extracted fields, reserialized/subset JSON, opt-in drift field differences, service names, or values deliberately emitted by scripts or summaries. Existing script output behavior is preserved.

No real configuration/secret values or sensitive logs were read; no historical logs were removed. No production workflow was dispatched, no deployment was performed, and no secrets, permissions, authentication grants, or cloud resources were changed. Live masking and OIDC authorization have not been exercised; reusable execution introduces a callee job_workflow_ref, while the original caller event identity is preserved. This PR stays draft for review.