fix: wire BUILD_IROH_SERVICES_API_KEY into bundle and release workflows

The diagnostics module reads BUILD_IROH_SERVICES_API_KEY via option_env!()
at compile time as a fallback when the runtime IROH_SERVICES_API_KEY isn't
set, but neither workflow exported the secret to the build env, so released
apps shipped without a key baked in and logged "Net diagnostics disabled:
IROH_SERVICES_API_KEY not set" on launch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: zachsmith1

.github/workflows/bundle.yml

@@ -19,6 +19,7 @@ jobs:
 
     env:
       BUILD_N0DES_API_SECRET: ${{ secrets.N0DES_API_SECRET }}
+      BUILD_IROH_SERVICES_API_KEY: ${{ secrets.BUILD_IROH_SERVICES_API_KEY }}
       BUILD_DATUM_CONNECT_RELAY_URLS: ${{ vars.BUILD_DATUM_CONNECT_RELAY_URLS }}
       BUILD_DATUM_CONNECT_CREATE_TRAFFIC_PROTECTION_POLICIES: ${{ vars.BUILD_DATUM_CONNECT_CREATE_TRAFFIC_PROTECTION_POLICIES }}
       DATUM_API_ENV: production

.github/workflows/manual-release.yml

@@ -23,6 +23,7 @@ jobs:
 
     env:
       BUILD_N0DES_API_SECRET: ${{ secrets.N0DES_API_SECRET }}
+      BUILD_IROH_SERVICES_API_KEY: ${{ secrets.BUILD_IROH_SERVICES_API_KEY }}
       BUILD_DATUM_CONNECT_RELAY_URLS: ${{ vars.BUILD_DATUM_CONNECT_RELAY_URLS }}
       BUILD_DATUM_CONNECT_CREATE_TRAFFIC_PROTECTION_POLICIES: ${{ vars.BUILD_DATUM_CONNECT_CREATE_TRAFFIC_PROTECTION_POLICIES }}
       DATUM_API_ENV: production