[mogita]

Problem

The Stream API key is an identifier, yet CI reads it from a repository secret. A secret cannot be read back, so nobody can see which test app CI runs against.

Solution

The workflows read the key from the STREAM_KEY Actions variable. The API secret stays a repository secret. STREAM_MULTI_TENANT_KEY reads its variable first and falls back to the secret until the variable is created.

How to verify

1. The CI run on this PR passes with the key coming from the variable.
2. After merge, the scheduled test workflow passes on the default branch and the STREAM_KEY repository secret is deleted.

---

Note

Low Risk
Workflow-only change that moves a non-secret API key to variables; secrets still gate credentials, with a migration fallback for multi-tenant keys.

Overview
CI, release, and scheduled test workflows now supply STREAM_KEY from the GitHub Actions vars.STREAM_KEY repository variable instead of secrets.STREAM_KEY, so the test app identifier is visible while STREAM_SECRET stays secret.

In ci.yml, STREAM_MULTI_TENANT_KEY prefers vars.STREAM_MULTI_TENANT_KEY and falls back to the existing secret until that variable exists. release.yml applies the same variable-based STREAM_KEY for Stream repo staging and Maven Central publish steps.

^{Reviewed by Cursor Bugbot for commit 0701619. Bugbot is set up for automated code reviews on this repo. Configure here.}