#9423 chore(ci): authenticate Trigger.dev deploys with per-environment API keys

Summary

• Trigger.dev deploy and promote jobs read TRIGGER_ACCESS_TOKEN from an environment-scoped secret: TRIGGER_ACCESS_TOKEN_PROD on main, TRIGGER_ACCESS_TOKEN_STAGING on staging, TRIGGER_ACCESS_TOKEN_PREVIEW for the dev preview branch
• Each falls back to the existing shared TRIGGER_ACCESS_TOKEN, so deploys keep working until the new secrets exist; the empty-token guards still fail fast
• Environment API keys with Deploy only access belong to the project environment, not to a member, so they survive org membership changes (a personal access token does not)
• Bumps the trigger.dev CLI and @trigger.dev/{sdk,core,build} from 4.5.16 to 4.7.6 (CLI and packages must match or the CLI aborts in CI):
  • 4.5.11 added env API keys for deploy, but promote only accepts them from 4.7.0
  • From 4.7.5 a --env that doesn't match the key's environment is an error; before, the deploy silently went to the key's environment
  • 4.7.6 is the newest release past the 7-day minimumReleaseAge
• Promote needs the same write:deployments scope as deploy, so a Deploy only key covers both

Type of Change

• Chore (CI / dependency)

Testing

• actionlint on both workflows (no new findings)
• Read the 4.5.16 → 4.7.6 changelogs for the CLI, SDK, core, and build: the changes are additive or limited to chat.agent, which this repo doesn't use; runtime is pinned to node-24, so the 4.7.2 default-runtime change doesn't apply; the zod override keeps 4.3.6
• CI type-check, tests, and audits on this PR; the deploy path itself first runs on the next push to staging

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)