fix(cd): keep 188 deploy key out of step env

.gitea/workflows/cd.yaml

@@ -834,11 +834,15 @@ jobs:
       # 感知層與備份通知都先走 AWOOI API/AwoooP，Telegram 直發只保留 API 離線 fallback。
       - name: Sync Ops Scripts to 188
         continue-on-error: true
-        env:
-          SSH_KEY_188: ${{ secrets.DEPLOY_SSH_KEY_188 }}
         run: |
           mkdir -p ~/.ssh
-          echo "$SSH_KEY_188" > "${HOME}/.ssh/deploy_key_188"
+          # 2026-05-13 Codex: do not pass multiline deploy keys through
+          # step-level env; Gitea Actions prints env values in job logs.
+          # Keep the secret scoped to this shell and write it directly to disk.
+          cat > "${HOME}/.ssh/deploy_key_188" <<'DEPLOY_KEY_188'
+          ${{ secrets.DEPLOY_SSH_KEY_188 }}
+          DEPLOY_KEY_188
+          sed -i 's/^          //' "${HOME}/.ssh/deploy_key_188"
           chmod 600 "${HOME}/.ssh/deploy_key_188"
           timeout -k 5s 10s ssh-keyscan 192.168.0.188 >> ~/.ssh/known_hosts 2>/dev/null \
             || echo "⚠️ 188 host key scan 失敗，改用 StrictHostKeyChecking=accept-new"