feat(infra): implement multi-environment deployment strategy

- Update CD workflow for branch-based environments (main -> Prod, dev -> Dev)
- Support Terraform workspaces for environment isolation
- Add manage_runtime_secrets flag to prevent accidental secret destruction
- Add infra management and secret setup utility scripts
- Prefix GitHub deployer identity with environment name
- Synchronize bot environment variables with latest runtime config

infra/terraform/variables.tf

@@ -83,13 +83,20 @@ variable "bot_assistant_model" {
   nullable    = true
 }
 
-variable "bot_assistant_router_model" {
-  description = "Optional ASSISTANT_ROUTER_MODEL override for bot runtime"
+variable "bot_topic_processor_model" {
+  description = "Optional TOPIC_PROCESSOR_MODEL override for bot runtime"
   type        = string
   default     = null
   nullable    = true
 }
 
+variable "bot_topic_processor_timeout_ms" {
+  description = "Optional TOPIC_PROCESSOR_TIMEOUT_MS override for bot runtime"
+  type        = number
+  default     = null
+  nullable    = true
+}
+
 variable "bot_assistant_timeout_ms" {
   description = "Optional ASSISTANT_TIMEOUT_MS override for bot runtime"
   type        = number
@@ -217,6 +224,12 @@ variable "labels" {
   default     = {}
 }
 
+variable "manage_runtime_secrets" {
+  description = "Whether Terraform should manage the creation of runtime secrets (disable if secrets are created manually)"
+  type        = bool
+  default     = true
+}
+
 variable "create_workload_identity" {
   description = "Create GitHub OIDC Workload Identity resources"
   type        = bool