Secrets + GitHub App credential cutover procedure for the new self-host GPU host

[JSONbored]

Part of #4325.

Context

The deployment's .env holds real secrets (GitHub App private key, webhook secret, AI provider keys, any BYOK material). These must reach the new host without ever passing through git history, an issue body, or a PR — and the app's ability to authenticate to GitHub must not lapse during the transfer.

Requirements

• Define the secure out-of-band channel for secret transfer (e.g. an encrypted transfer directly between the two hosts, or a secrets manager) — the specific mechanism should be recorded in internal/private operational notes, not in this public issue.
• The GitHub App private key and webhook secret must be present and correct on the new host before any webhook traffic is pointed at it — verify with a non-destructive authenticated API call (e.g. fetch the App's own installation list) before relying on it for anything live.
• Confirm no secret value is ever echoed into a shell history, log line, or committed file at any point in this procedure — this issue's own deliverables should describe verification steps that catch that rather than trusting a one-time careful copy.

Deliverables

• Secret-transfer mechanism chosen and exercised once as a dry run
• New host's GitHub App credentials verified working via a read-only authenticated API call
• Confirmed (history scan on this issue and any linked PRs) that no secret value ever appears in git history or public issue/PR text
• AI provider keys / BYOK material (if configured) transferred and verified the same way

Expected outcome

The new host can authenticate to GitHub and any configured AI providers with zero secret material ever having touched a public or version-controlled surface.

Effort

M

[linear-code]

JSO-3307

[JSONbored]

Status check (2026-07-09): Functionally verified the new host authenticates correctly — /ready reports ai_provider: true, and the host is actively processing real GitHub webhook-driven jobs (confirmed in its own logs), which wouldn't be possible without working GitHub App credentials.

By this issue's own design, the specific transfer mechanism and history-scan confirmation belong in private operational notes, not here — so their absence from this public issue isn't itself a red flag. I have no way to verify those specific steps from outside. Recommend closing this one yourself once you've confirmed the private-notes side is actually filled in, rather than me inferring it from functional success alone. Leaving open.