Migrate CI-time secret workflows to a deployment environment and re-enable zizmor secrets-outside-env

[potiuk]

Follow-up to #69460. That issue (and its first PR) moves the release-management workflows to an RM-gated release deployment environment. This issue covers the remaining secret-using workflows, which are a different case: most run automatically on every PR/push (SLACK notifications, Codecov, docs-staging AWS upload) and therefore must not require release-manager approval — so they need a separate, non-gated environment purely to scope their secrets, not to restrict who runs them.

Scope

• Define a non-gated environment (e.g. ci) for CI-time secrets and move SLACK_BOT_TOKEN, CODECOV_TOKEN, DOCS_AWS_*, CONSTRAINTS_GITHUB_REPOSITORY into it.
• Convert the CI-time secret consumers: ci-amd.yml, ci-arm.yml, ci-image-checks.yml, ci-image-build.yml, prod-image-build.yml, push-image-cache.yml, run-unit-tests.yml, integration-system-tests.yml, ci-notification.yml, ci-duration-monitor.yml, e2e-flaky-tests-report.yml, the scheduled/upgrade-check workflows, and update-constraints-on-push-stable.yml.
• Convert the remaining release workflows that need restructuring: registry-backfill.yml / registry-build.yml (entry job is a reusable-workflow call, so add a small gating job), and release_single_dockerhub_image.yml (scope DOCKERHUB_*).
• Once every secret-using workflow references an environment, remove secrets-outside-env: disable: true from .github/zizmor.yml so the audit enforces the pattern going forward.

Blocked on the environments existing (ASF INFRA), same as #69460.

---

Drafted-by: Claude Code (Opus 4.8); reviewed by @potiuk before posting

[cschanhniem]

Nice work on scoping CI secrets to a dedicated environment. For repos managing contributions from both humans and AI agents, AGENTOWNERS provides an additional policy layer to define what automated actors can do across different workflow contexts — extending least-privilege from token scoping to agent-level action governance.