ci: remove temporary production secret relay

[hseshadr]

Summary

• remove the one-time production secret migration workflow and relay implementation
• remove the relay-only public Dagger function and contract fixtures
• restore the permanent four-workflow Dagger-only ingress surface

Verification

• 84 permanent deployment/Foundation/workflow contracts pass
• public Dagger contract suite: 19/19
• TypeScript, actionlint, zizmor offline, and diff checks pass
• independent review: Ready Yes, no cleanup findings

Merge gate

Do not merge until the exact-main environment-backed deploy is green and the four repository source secrets are deleted.