Move placeholder secret validation to compile-time for release builds

[ChristianPavilonis]

Debug and test builds currently fail at runtime when placeholder secrets from trusted-server.toml haven't been overridden via env vars. This forces developers to set secret env vars even for local iteration.

Move the reject_placeholder_secrets() check to a compile-time gate in build.rs for release builds only, and guard the runtime check with cfg(not(debug_assertions)). This lets debug/test builds pass through with default placeholders while keeping release builds safe.