Read the tarball host and path from secrets, not variables

Run logs of a public repository are public, and Gitea prints variables in
them in clear text; only secrets are masked. They are now set only on the
publish step, the one step that needs them.

Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9

.gitea/workflows/build.yml

@@ -32,8 +32,6 @@ concurrency:
 # host, state.json or the AUR.
 env:
   AUR_MAINTAINER: ${{ vars.AUR_MAINTAINER }}
-  TARBALL_HOST: ${{ vars.TARBALL_HOST }}
-  TARBALL_PATH: ${{ vars.TARBALL_PATH }}
   TARBALL_BASE_URL: ${{ vars.TARBALL_BASE_URL }}
   WORK_DIR: /work
 
@@ -126,6 +124,10 @@ jobs:
         if: vars.PUBLISH == 'true'
         env:
           TARBALL_SSH_KEY: ${{ secrets.TARBALL_SSH_KEY }}
+          # Secrets, not variables: run logs of a public repo are public, and
+          # Gitea prints variables in them but masks secrets.
+          TARBALL_HOST: ${{ secrets.TARBALL_HOST }}
+          TARBALL_PATH: ${{ secrets.TARBALL_PATH }}
         run: |
           ASSET="$(python3 -c 'import json;print(json.load(open("release-meta.json"))["tarball"])')"
           bash scripts/publish-tarball.sh "${WORK_DIR}/out/${ASSET}"