Deployment protection bypass (#298)

* test preview bypass 2

Co-authored-by: Cursor <cursoragent@cursor.com>

* add apiFetch wrapper with Vercel bypass via query param + header

the template workflow was missing VERCEL_AUTOMATION_BYPASS_SECRET,
so all action API calls to preview deployments hit Vercel's
deployment protection without bypass. this also consolidates the
bypass logic into a single fetch wrapper that applies the secret
as both a query parameter (matching server-side forwarding) and
a header for belt-and-suspenders reliability.

Co-authored-by: Cursor <cursoragent@cursor.com>

* security hardening for Vercel bypass

- redact bypass token from webhook forwarder logs and response body
- remove dead x-preview-api-forward header
- refactor getAllSecrets() to use SENSITIVE_PATTERNS instead of hardcoded list
- enforce https:// on API_URL (localhost exempt for local dev)

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

utils/secrets.ts

@@ -3,7 +3,6 @@
  * Redacts actual secret values rather than using pattern matching
  */
 
-import { agentsManifest } from "../external.ts";
 import { getGitHubInstallationToken } from "./token.ts";
 
 // patterns for sensitive env var names
@@ -52,28 +51,14 @@ export function resolveEnv(mode: EnvMode | undefined): Record<string, string | u
 function getAllSecrets(): string[] {
   const secrets: string[] = [];
 
-  // get all API key values from agent manifest
-  for (const agent of Object.values(agentsManifest)) {
-    for (const keyName of agent.apiKeyNames) {
-      const envKey = keyName.toUpperCase();
-      const value = process.env[envKey];
-      if (value) {
-        secrets.push(value);
-      }
+  // collect all env var values matching SENSITIVE_PATTERNS
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value && isSensitiveEnvName(key)) {
+      secrets.push(value);
     }
   }
 
-  // for OpenCode: also scan all API_KEY environment variables (since apiKeyNames is empty)
-  const opencodeAgent = agentsManifest.opencode;
-  if (opencodeAgent && opencodeAgent.apiKeyNames.length === 0) {
-    for (const [key, value] of Object.entries(process.env)) {
-      if (value && typeof value === "string" && key.includes("API_KEY")) {
-        secrets.push(value);
-      }
-    }
-  }
-
-  // add GitHub installation token
+  // add GitHub installation token (stored in memory, not in env)
   try {
     const token = getGitHubInstallationToken();
     if (token) {