Read the tarball host from a secret, not a variable

Run logs of a public repository are public, and Gitea prints variables in
them in clear text; only secrets are masked.

Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9

.gitea/workflows/aur-publish.yml

@@ -116,7 +116,7 @@ jobs:
           printf '%s\n' "$TARBALLZ_SSH_KEY" > ~/.ssh/tarballz
           chmod 600 ~/.ssh/tarballz
           ssh -i ~/.ssh/tarballz -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
-            "${{ vars.TARBALLZ_TARGET }}" < aur-pkg/PKGBUILD
+            "${{ secrets.TARBALLZ_TARGET }}" < aur-pkg/PKGBUILD
 
   # ahfail-bin: the same release, prebuilt. The binary is built from the TAG
   # (also when this runs by hand from master), staged as a `meson install` tree,
@@ -186,7 +186,7 @@ jobs:
           # Forced command on the web host: this key may only write ahfail-*.tar.*
           # and ahfail-bin.PKGBUILD, and keeps the newest three tarballs.
           ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
-            "${{ vars.TARBALLZ_TARGET }}" "tarball ${{ steps.tarball.outputs.name }}" < "${{ steps.tarball.outputs.name }}"
+            "${{ secrets.TARBALLZ_TARGET }}" "tarball ${{ steps.tarball.outputs.name }}" < "${{ steps.tarball.outputs.name }}"
 
       - name: Verify the public URL serves the same bytes
         run: |
@@ -244,4 +244,4 @@ jobs:
         continue-on-error: true
         run: |
           ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
-            "${{ vars.TARBALLZ_TARGET }}" < aur-bin-pkg/PKGBUILD
+            "${{ secrets.TARBALLZ_TARGET }}" < aur-bin-pkg/PKGBUILD