ci: move Actions secrets into protected environments

[kiyoakii]

Why

Repository-level Actions secrets are handed to any workflow run in the repository, including a workflow file pushed on a fresh branch. A secret stored in an environment is handed only to jobs that declare that environment, and an environment whose deployment branch policy allows only main refuses jobs from any other ref. So a workflow pushed on a new branch can no longer read it.

TOKENLIST_SECRET is used only by the generate job in generate.yml, which runs on push to main (paths data/**, src/**, the workflow itself) and on manual dispatch. Every run of that workflow so far has been on main. This PR adds environment: publish to that job and changes nothing else. lint.yml and validate.yml use no secrets and are unchanged.

Secret -> environment

Secret	Environment	Allowed refs	Required reviewers
TOKENLIST_SECRET	publish	main only	Recommended: the token holds write access and its output is the published token list. The job runs only after merges that touch data/ or src/, so approvals are infrequent.

Maintainer steps, in order

1. Settings -> Environments -> New environment publish.
   • Deployment branches and tags: Selected branches and tags -> add main only.
   • Required reviewers: add the maintainers (recommended), and leave "Allow administrators to bypass configured protection rules" off.
2. Rotate the token: create a new one, preferably a fine-grained PAT or GitHub App token limited to this repository with Contents: read and write, and revoke the old one. Add the new value as the environment secret TOKENLIST_SECRET in publish.
3. Delete the repository-level secret TOKENLIST_SECRET (Settings -> Secrets and variables -> Actions -> Repository secrets).
   Until this PR is merged, a push to main that triggers generate will fail because the job cannot see the environment secret yet. Keep this step and the next one close together.
4. Mark this PR ready for review and merge it.
5. Run "Generate Token List" from main (workflow_dispatch) once to confirm it works. Manual runs must be started from main; the environment refuses other branches.

Do not merge before step 1. Otherwise the first run creates publish automatically with no branch policy.

Secrets still needed on unprotected refs

None. No pull_request or other-branch job reads a secret.

Follow-up (not in this PR)

• actions/setup-node also receives TOKENLIST_SECRET as token. That input is only used to download Node.js from GitHub and works with the default token. Passing the write token there is not needed.