ci: migrate secrets to 1Password

[tobyhede]

Summary

• Migrates all GitHub Actions secrets to 1Password
• Uses 1password/load-secrets-action@v3 with export-env: true
• Single shared template file .github/secrets.env.tpl

Changes

• Added .github/secrets.env.tpl with all secret references
• Updated test.yml, benchmark.yml, release.yml, release-aws-marketplace.yml

Prerequisites (already done)

• 1Password service account created with read access to CI vault
• OP_SERVICE_ACCOUNT_TOKEN added to GitHub repo secrets
• Items created in 1Password CI vault

Test plan

• test.yml workflow passes
• benchmark.yml workflow passes
• release.yml workflow passes (on next push to main)
• release-aws-marketplace.yml workflow passes (on next release)