Switch VAULT_ROLE_ID, VAULT_SECRET_ID, and K8S_CA_CERT from Gitea repo
secrets to shell env vars, which are injected via the runner host's
systemd EnvironmentFile — keeping credentials off Gitea entirely.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Split curl calls into separate variables and log intermediate
responses to stderr to identify which request is failing.
Added set -euxo pipefail for immediate failure visibility.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
