ci(S15P11A705-154): runtime Secret 봉인 계약을 정렬한다

.github/workflows/seal-runtime-secrets.yml

@@ -0,0 +1,30 @@
+name: seal-runtime-secrets
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  seal:
+    name: seal / ai-dev
+    runs-on: ubuntu-latest
+    environment: pinlog-secrets-dev
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+      - name: Seal runtime Secrets and open the Infra PR
+        uses: Team-PinLog/infra/.github/actions/sealedsecret-infra-pr@84458bf35e341b79e91ce21a3667e9d3f7454068
+        env:
+          GMS_API_KEY: ${{ secrets.GMS_API_KEY }}
+          GMS_BASE_URL: ${{ secrets.GMS_BASE_URL }}
+          INTERNAL_SHARED_SECRET: ${{ secrets.INTERNAL_SHARED_SECRET }}
+          PINLOG_INFRA_SECRET_PR_TOKEN: ${{ secrets.PINLOG_INFRA_SECRET_PR_TOKEN }}
+        with:
+          policy: ai-dev
+          revision: ${{ github.sha }}

docs/WORKLOG.md

@@ -4,6 +4,7 @@
 
 | 날짜 | 작업 | 관련 문서 |
 |---|---|---|
+| 2026-07-29 | S15P11A705-154 — protected Environment 기반 3 runtime owner 값 + Infra PR credential handoff를 canonical workflow로 정렬 | [runtime Secret handoff](implements/2026-07-29-sealed-secret-handoff.md) |
 | 2026-07-23 | AI 공용 설계를 docs `static/05` 단일 원본으로 확립 (docs#2) | [proposals](proposals/README.md) (P16) |
 | 2026-07-23 | FastAPI AI 서버 구현 명세 작성 + version→deletion race 리네임 (ai#1) | [spec/](spec/) |
 | 2026-07-23 | Keyword Preset seed 27개 (ai#2) | [implements](implements/2026-07-23-keyword-preset-seed.md), [spec/keyword-preset.md](spec/keyword-preset.md) |