fix(ci): keep the credentials out of the process list

Two small changes to the deploy job:

- The registry password went through `-u armistace:$PASSWORD` on the curl
  command line, where it is visible in the process list for the duration of
  the request. It now goes through a curl config file on stdin instead.

- The kubeconfig is written with mode 600 rather than the default, and is
  removed at the end of the job (with `if: always()`, so it is removed even
  if a later step fails). It is cluster-admin-equivalent, so it should not
  be readable by anything else on the runner.

Verified: `curl --config -` against the registry returns the same digest as
the `-u` form.

.gitea/workflows/build_push.yml

@@ -114,7 +114,12 @@ jobs:
       - name: Create Kubeconfig
         run: |
           mkdir -p $HOME/.kube
+          # Written with restrictive permissions: the kubeconfig is
+          # cluster-admin-equivalent, so it should not be readable by
+          # anything else on the runner.
+          install -m 600 /dev/null $HOME/.kube/config
           echo "${{ secrets.KUBEC_CONFIG_BUILDX }}" > $HOME/.kube/config
+          chmod 600 $HOME/.kube/config
 
       - name: Install kubectl
         run: |
@@ -171,6 +176,10 @@ jobs:
             exit 1
           fi
 
+      - name: Remove the kubeconfig
+        if: always()
+        run: rm -f $HOME/.kube/config
+
       - name: Smoke test the deployed app
         run: |
           # Check the app's own port from inside the pod, AND the Service in