CLI automation and CI

Create one CI key per job or environment, store it in the CI secret manager, and grant it only the read or write scopes that job requires. Pin the workspace explicitly in deployment jobs.

Use JSON output, capture the run ID, and make the job fail on an unsuccessful result. For writes, pass an idempotency key or use an external identifier that makes reruns safe. Never widen a CI key merely to avoid handling a permission failure.