deploy-web read the production Convex key and Cloudflare token as plain
repository secrets, so they cannot move to the Production environment
without breaking the web deploy. With environment: Production the job reads
environment secrets once they exist and repository secrets meanwhile.
release_process.md said both 'Production environment' and 'repository
secrets' for the same key; it now says Production, and how the move works.