chore: add secrets migration workflow to kdf-internal

Temporary workflow to copy Actions secrets from GLEECBTC/komodo-defi-framework
to the new private GLEECBTC/kdf-internal repo.

Uses jpoehnelt/secrets-sync-action pinned to SHA 7840777 (v1.10.0).
Triggered manually via workflow_dispatch. Defaults to dry_run=true.

To be reverted after migration completes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: shamardy

.github/workflows/migrate-secrets.yml

@@ -0,0 +1,62 @@
+name: Migrate secrets to kdf-internal
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Dry run (true = preview only, false = actually write)"
+        required: true
+        default: "true"
+        type: choice
+        options:
+          - "true"
+          - "false"
+
+jobs:
+  migrate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Sync secrets to GLEECBTC/kdf-internal
+        uses: jpoehnelt/secrets-sync-action@7840777f242539d96b60477b66aa1c179e7644ea  # v1.10.0
+        with:
+          secrets: |
+            ^ALICE_PASSPHRASE_LINUX$
+            ^ALICE_USERPASS_LINUX$
+            ^BOB_PASSPHRASE_LINUX$
+            ^BOB_USERPASS_LINUX$
+            ^CLOUDFLARE_ACCOUNT_ID$
+            ^CLOUDFLARE_API_TOKEN$
+            ^DOCKER_HUB_USERNAME$
+            ^DOCKER_HUB_ACCESS_TOKEN$
+            ^ATOMICDEX_DEPLOYMENTS_SSH$
+            ^VT_API_KEY$
+            ^TELEGRAM_API_KEY$
+            ^FILE_SERVER_HOST$
+            ^FILE_SERVER_PORT$
+            ^FILE_SERVER_USERNAME$
+            ^FILE_SERVER_KEY$
+          repositories: |
+            GLEECBTC/kdf-internal
+          repositories_list_regex: false
+          github_token: ${{ secrets.MIGRATION_PAT }}
+          dry_run: ${{ inputs.dry_run == 'true' }}
+          concurrency: 1
+        env:
+          ALICE_PASSPHRASE_LINUX:    ${{ secrets.ALICE_PASSPHRASE_LINUX }}
+          ALICE_USERPASS_LINUX:      ${{ secrets.ALICE_USERPASS_LINUX }}
+          BOB_PASSPHRASE_LINUX:      ${{ secrets.BOB_PASSPHRASE_LINUX }}
+          BOB_USERPASS_LINUX:        ${{ secrets.BOB_USERPASS_LINUX }}
+          CLOUDFLARE_ACCOUNT_ID:     ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN:      ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          DOCKER_HUB_USERNAME:       ${{ secrets.DOCKER_HUB_USERNAME }}
+          DOCKER_HUB_ACCESS_TOKEN:   ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+          ATOMICDEX_DEPLOYMENTS_SSH: ${{ secrets.ATOMICDEX_DEPLOYMENTS_SSH }}
+          VT_API_KEY:                ${{ secrets.VT_API_KEY }}
+          TELEGRAM_API_KEY:          ${{ secrets.TELEGRAM_API_KEY }}
+          FILE_SERVER_HOST:          ${{ secrets.FILE_SERVER_HOST }}
+          FILE_SERVER_PORT:          ${{ secrets.FILE_SERVER_PORT }}
+          FILE_SERVER_USERNAME:      ${{ secrets.FILE_SERVER_USERNAME }}
+          FILE_SERVER_KEY:           ${{ secrets.FILE_SERVER_KEY }}