ci: migrate deploy to HANZO_API_KEY + KMS

Replace direct DIGITALOCEAN_ACCESS_TOKEN with KMS credential fetch
using HANZO_API_KEY for multi-cluster bootnode deployment.

.github/workflows/ci.yml

@@ -229,10 +229,28 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Fetch deploy credentials from KMS
+        id: kms
+        env:
+          HANZO_API_KEY: ${{ secrets.HANZO_API_KEY }}
+          KMS_ENDPOINT: ${{ vars.KMS_ENDPOINT || 'https://kms.hanzo.ai' }}
+        run: |
+          response=$(curl -sf "${KMS_ENDPOINT}/api/v1/secrets/raw?secretPath=/deploy&environment=production" \
+            -H "Authorization: Bearer ${HANZO_API_KEY}" 2>/dev/null || echo "")
+          if [ -n "$response" ]; then
+            token=$(echo "$response" | jq -r '.secrets[] | select(.secretKey=="DO_API_TOKEN") | .secretValue // empty')
+          fi
+          if [ -z "${token:-}" ]; then
+            echo "::error::Deploy credentials not found. Set HANZO_API_KEY with KMS access."
+            exit 1
+          fi
+          echo "::add-mask::${token}"
+          echo "token=${token}" >> "$GITHUB_OUTPUT"
+
       - name: Install doctl
         uses: digitalocean/action-doctl@v2
         with:
-          token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
+          token: ${{ steps.kms.outputs.token }}
 
       - name: Save DigitalOcean kubeconfig (bootnode-k8s)
         run: doctl kubernetes cluster kubeconfig save ${{ secrets.K8S_CLUSTER_NAME }}