feat: distribute Hero WARP enrollment secrets

[xnoto]

Summary

Declare the two already-encrypted Hero WARP enrollment source fields as narrowly scoped GitHub Actions secrets for the private hero-host-config repository:

• HERO_HOST_CONFIG_WARP_CLIENT_ID
• HERO_HOST_CONFIG_WARP_CLIENT_SECRET

The generic organization-wide Cloudflare authentication-secret broadcast remains explicitly excluded from hero-host-config.

Fixes #

None.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — opentofu / test and opentofu / plan passed.
• The owning OpenTofu root centrally declares the Actions-secret distribution; no target-repository secret or workflow was hand-edited.

No local OpenTofu init, plan, apply, import, state, or secret-decryption operation was run or claimed by the agent.

Impact and rollout

Producer: tfroot-cloudflare previously created the dedicated service token; tfroot-github main now contains its owner-authored SOPS-encrypted source fields. This PR adds only their non-secret distribution declarations.

Consumer: after a reviewed merge and environment-gated main apply, hero-host-config receives exactly the two named Actions secrets. No other repository receives them.

Unchanged: no generic Cloudflare secret distribution, WARP enrollment, Cloudflared migration, GitHub Actions execution, host configuration, or live host mutation is included.

Delivery stages: authored, submitted, and CI-validated. Merge and the environment-gated root apply remain separate confirmation-gated stages. Workflow credential selection, host reconciliation, and functional verification are future stages.

Rollback: before apply, close or revert this PR. After an apply, remove these two mappings through a reviewed change and apply; rotate the Cloudflare service token separately if revocation is needed.

Safety and secrets

• Contains only SOPS field references and secret metadata; no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints are included.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• The distribution scope, confirmation-gated apply, and rollback path are described above.

AI-assisted change: an OpenCode agent prepared this non-secret OpenTofu mapping and pull request. The encrypted source material was owner-authored and was not retrieved or changed by the agent.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "hero-host-config"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "hero-host-config"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

Plan: 2 to add, 0 to change, 0 to destroy.
OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "hero-host-config"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "hero-host-config"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

Plan: 2 to add, 0 to change, 0 to destroy.