[gilmishal]

Summary

• remove runtime Auth0 client-credentials token minting
• authenticate publishing with the shared token for catalog organization flox
• source the runtime credential exclusively through DeltaOps

Authentication design

Service account flox-ci-publisher has read-write access to flox. Password field flox-ci-publisher in github-actions / Flox SATs Server is authoritative.

DeltaOps syncs it to MANAGED_FLOX_FLOXHUB_TOKEN, shared by repositories publishing to flox; this workflow exposes it as FLOX_FLOXHUB_TOKEN at runtime.

Rollout

Land DeltaOps #753 and run the sync before merging.

Verification

• git diff --check
• no token values are included
• no builds or tests were run