CI: build the telemetry broker into releases from repository secrets

[elliotmatson]

Release builds get the MQTT broker settings from repository secrets, so cubes running CI-built firmware report telemetry and accept settings (#83).

• build-release.yml: passes MQTT_URL, MQTT_USER and MQTT_PASSWORD through pio-actions' new build-env secret (v1.9.0; @v1 already points to it). Each value is masked in the logs, and pre-build-run calls the new script.
• scripts/write_secrets.py: writes lib/cube/secrets.h with the values escaped as C string literals, so any password is safe. Without MQTT_URL it writes nothing and the firmware doesn't report, which is exactly today's behaviour. I checked a password containing a quote and a backslash: the header compiles.
• Docs: CLAUDE.md's CI section describes it.

Before this does anything: add the three repository secrets (Settings → Secrets and variables → Actions). Until then this PR's own build runs without them.

Note: compiled-in values can be read from any release. The broker's ACL (README, Telemetry) is what limits the shared login, and I probed it: another client ID can't read a cube's topics or send it commands.

🤖 Generated with Claude Code

[github-actions]

Tests

124/124 passed.

Suite	Tests	Passed	Failed	Time
native:test_firmware_image	14	14	0	3.27s
native:test_pong	6	6	0	0.73s
native:test_remote	7	7	0	0.76s
native:test_rubiks	7	7	0	0.61s
native:test_timezones	5	5	0	0.60s
native:test_sand	6	6	0	0.60s
native:test_bounce	6	6	0	0.59s
native:test_maze	4	4	0	0.60s
native:test_cube_geometry	22	22	0	0.72s
native:test_life	7	7	0	0.60s
native:test_noise	5	5	0	0.72s
native:test_breakout	6	6	0	0.59s
native:test_wordclock	5	5	0	0.59s
native:test_color	6	6	0	0.58s
native:test_langton	5	5	0	0.60s
native:test_particles	7	7	0	0.61s
native:test_weather	6	6	0	0.67s

[github-actions]

Static analysis

No defects found.

_{pio check, failing on high and above. 1 defect in downloaded dependencies withheld; pass include-dependencies to see them.}

[github-actions]

Firmware size

+85.0 KB across 1 environment.

Env	Image	Δ	App partition	Flash Δ	RAM Δ
esp32-s3-devkitc-1 ⚠️	1.88 MB	+85.0 KB	23.6% → 24.69%	+85.0 KB	+145.3 KB

esp32-s3-devkitc-1 — 9 section(s) changed

Section	Base	Head	Δ
.flash.text	1.17 MB	1.24 MB	+67.9 KB
.ext_ram.dummy	1.75 MB	1.81 MB	+64.0 KB
.flash_rodata_dummy	1.19 MB	1.25 MB	+64.0 KB
.flash.rodata	517.6 KB	534.2 KB	+16.6 KB
.dram0.dummy	87.5 KB	88.0 KB	+512 B
.iram0.text	102.4 KB	102.9 KB	+488 B
.dram0.bss	37.8 KB	37.9 KB	+184 B
.iram0.text_end	61 B	85 B	+24 B
.dram0.data	23.8 KB	23.8 KB	+16 B

esp32-s3-devkitc-1 — 482 symbol(s) changed

Symbol	Base	Head	Δ
esp_mqtt_task	0 B	4.5 KB	+4.5 KB
Telemetry::publishBoot()	0 B	2.8 KB	+2.8 KB
Telemetry::publishCrash(bool)	0 B	2.8 KB	+2.8 KB
Telemetry::scanInto(ArduinoJson::V743PB22::JsonArray, int)	0 B	2.1 KB	+2.1 KB
esp_mqtt_set_config	0 B	2.0 KB	+2.0 KB
_ZNK11ArduinoJson8V743PB226detail11VariantData6acceptINS1_14JsonSerializerINS1_6WriterI6StringvEEEEEENT_11result_typeERS9_PKNS1_15ResourceManagerE$isra$0	1.5 KB	3.4 KB	+2.0 KB
Telemetry::publishSettings()	0 B	1.9 KB	+1.9 KB
ws_read	0 B	1.5 KB	+1.5 KB
Telemetry::publishLocation()	0 B	1.5 KB	+1.5 KB
tcp_connect	638 B	2.0 KB	+1.4 KB
Telemetry::publishHealth()	0 B	1.4 KB	+1.4 KB
Telemetry::publishNetwork()	0 B	1.3 KB	+1.3 KB
Telemetry::publishUsage()	0 B	1.3 KB	+1.3 KB
ws_connect	0 B	1.2 KB	+1.2 KB
Telemetry::handleCommand(char const*, char const*, unsigned int)	0 B	1.2 KB	+1.2 KB
+467 more

_{Baseline: 86a886a. Image size is firmware.bin against the smaller app partition slot. RAM is static allocation only — the linker cannot see heap or stack.}