Why

BUILDBUDDY_API_KEY now lives in the bazel GitHub Actions environment as an environment secret. Jobs that need BuildBuddy credentials must opt into that environment so ${{ secrets.BUILDBUDDY_API_KEY }} resolves from the protected environment secret instead of relying on an unscoped repository/organization secret.

This follows the same environment-secret migration pattern as #26466.

What Changed

• Attach each workflow job that reads BUILDBUDDY_API_KEY to the bazel environment.
• Set deployment: false on those job-level environment blocks.

deployment: false lets the job enter the bazel environment to access its environment secrets without creating GitHub deployment records for these CI jobs. That keeps the environment as a secret/access-control boundary without making ordinary Bazel CI runs look like deploys.

Validation

• Parsed the modified workflow YAML files with Ruby's YAML parser.
• Checked the modified workflow files for trailing whitespace.