ci: enable turbo remote cache on trusted publish events

Wire TURBO_API/TURBO_TEAM literals and TURBO_TOKEN (org secret turbo_token,
events push/tag/cron/manual/deployment) into publish.yml verify and build
steps. PR pipelines stay local-cache-only by design (cache-poisoning surface).
Replace the stale ci.yml comment that referenced nonexistent repository-level
environment variables. Cache backend: k8s app turbo-cache (ducktors 2.7.4)
at turbo.mosaicstack.dev, verified serving /v8/artifacts/status 200.

Measured baseline: publish verify step 1050s all cache-miss vs 31s intra-run
cache-hit build step (pipeline 2677).

.woodpecker/publish.yml

@@ -73,6 +73,13 @@ steps:
   # being empty) and on any incomplete verification.
   verify:
     image: *node_image
+    environment:
+      # Turbo remote cache (see .woodpecker/ci.yml header comment): org-level
+      # secret, exposed only on trusted events (push/tag/cron/manual/deployment).
+      TURBO_API: https://turbo.mosaicstack.dev
+      TURBO_TEAM: mosaic
+      TURBO_TOKEN:
+        from_secret: turbo_token
     commands:
       - *enable_pnpm
       # (a) Commit identity: the provider's claimed SHA must equal the actual
@@ -108,6 +115,13 @@ steps:
 
   build:
     image: *node_image
+    environment:
+      # Turbo remote cache (see .woodpecker/ci.yml header comment): org-level
+      # secret, exposed only on trusted events (push/tag/cron/manual/deployment).
+      TURBO_API: https://turbo.mosaicstack.dev
+      TURBO_TEAM: mosaic
+      TURBO_TOKEN:
+        from_secret: turbo_token
     commands:
       - *enable_pnpm
       - pnpm build