chore: remove one-shot secret migration

[gltanaka]

Summary

• Removes the completed one-shot migration trigger, jobs, state harness, and temporary credential surface.
• Preserves the protected normal heal path, its pdd-cloud-read environment binding, SHA-pinned App-token action, and metadata-only permission request.
• Adds policy coverage for the sole App-secret consumer, exact normal token action pin, normal PEM boundary, and absence of migration surface.

DO NOT MERGE

This is a draft stacked PR against fix/1932-m0-secret-migration; do not merge, ready for review, or retarget it to main until every post-dispatch condition below has been independently verified.

After PR #2312 has merged and its one-shot migration has been manually dispatched from protected main, verify all of the following before merging this cleanup:

• The dispatch succeeded and proved the exact promptdriven/pdd_cloud canary with an App token minted from the pdd-cloud-read environment secrets.
• The per-run App token revocation succeeded before retirement of repository-level App-secret copies.
• PDD_CLOUD_APP_ID and PDD_CLOUD_APP_PRIVATE_KEY are present only in the branch-policy-gated, protected pdd-cloud-read environment and absent from repository secrets.
• PDD_SECRET_MIGRATION_TOKEN is absent from both repository and environment secret bindings after retirement.
• The underlying temporary migration credential has been revoked out of band after successful cleanup.

This PR does not change credentials, GitHub Apps, environment settings, dispatch state, or merge state.

Validation

• Python 3.12 focused auto-heal/YAML policy smoke passed.
• python -m pytest -q tests/test_sync_core_pdd_rollout_policy.py -k auto_heal (6 passed).
• git diff --check passed.