ci: rust-hermetic leg consumes cortexkit-ci app tokens (scoped to the two siblings, persist-credentials off) — replaces the never-activated deploy-key shape

Co-authored-by: Alfonso <alfonso-magic-context@users.noreply.github.com>