#32470 ci: one-off job that puts the missing production platform secrets on cmux-platform-production

NEXT Cloud's CloudDO is moving to cmux-platform in production (development and staging already passed). cmux-platform-production needs JWT_PRIVATE_JWK and CLOUD_LINK_SIGNING_KEYS equal to cmux-api production's, plus CLOUD_FREESTYLE_API_KEY.

This reuses the pattern of #30461 (platform-dev-secrets.yml, removed in #30813) for production:

• environment cmux-next-production (branch policy: feat-cmux-next), runs once on the push that lands it (path-filtered to this file) since GitHub registers dispatch workflows only from main.
• writes only those three names on cmux-platform-production, only when the Worker lacks the name: it never overwrites an existing secret.
• a name the environment holds no copy of is skipped with a warning, never minted. Today cmux-next-production holds FREESTYLE_API_KEY only, so this run places CLOUD_FREESTYLE_API_KEY; the JWK and link keys can be placed by a later dispatch once their production copies are in the environment.
• values go through stdin to wrangler secret put; the job prints secret names only.
• no permission or runner changes (contents: read, same runner expression as #30461).

A follow-up drops the push trigger (dispatch-only).

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds a one-off GitHub Actions workflow that copies the production platform secrets onto cmux-platform-production for NEXT Cloud's CloudDO move into cmux-platform in production.

• Pipes JWT_PRIVATE_JWK, CLOUD_LINK_SIGNING_KEYS, and CLOUD_FREESTYLE_API_KEY from the cmux-next-production environment via stdin to wrangler secret put, printing only secret names.
• Writes each name only when the Worker lacks it; existing secrets are never overwritten.
• Skips with a warning any name the environment doesn't hold; it never mints new values.
• Runs once on the push that lands it (path-filtered to this file) because GitHub registers dispatch workflows only from main; a follow-up drops the push trigger.