ci: load deploy secrets from openbao

.gitea/workflows/release.yml

@@ -12,6 +12,7 @@ env:
   ADMIN_API_IMAGE: git.itexp.me/bsodfather/crank-community-admin-api
   MCP_SERVER_IMAGE: git.itexp.me/bsodfather/crank-community-mcp-server
   UI_IMAGE: git.itexp.me/bsodfather/crank-community-ui
+  OPENBAO_ENV_FILE: .openbao-env
 
 jobs:
   release:
@@ -60,10 +61,18 @@ jobs:
             dir:/workspace -o spdx-json \
             > dist/crank-community-${IMAGE_TAG}-sbom.spdx.json
 
+      - name: Load deployment secrets from OpenBao
+        env:
+          BAO_ADDR: ${{ secrets.BAO_ADDR }}
+          BAO_TOKEN: ${{ secrets.BAO_TOKEN }}
+          BAO_SECRET_PATH: ${{ secrets.BAO_SECRET_PATH }}
+        run: scripts/load-openbao-env.sh
+
       - name: Login to registry
         run: |
-          printf '%s' '${{ secrets.DEPLOY_REGISTRY_TOKEN }}' | \
-            docker login '${{ env.REGISTRY }}' -u '${{ secrets.DEPLOY_REGISTRY_USER }}' --password-stdin
+          . "$OPENBAO_ENV_FILE"
+          printf '%s' "$DEPLOY_REGISTRY_TOKEN" | \
+            docker login '${{ env.REGISTRY }}' -u "$DEPLOY_REGISTRY_USER" --password-stdin
 
       - name: Build and push release images
         run: |