fix(security): treat source token_ref as a secret reference, not a raw stored PAT

[pparage]

The deploy path treats source.token_ref as the literal PAT rather than a reference into a secret store. Acknowledged debt: tokens live in the DB/workspace in plaintext. Move to a proper secret reference so raw tokens are not persisted.