PR workflows are treated as deployments by GitHub

GitHub is registering Deployments for workflows that run on Pull Requests because they use `environment` to determine which secret/variable versions to use — `dev` or `prod`.

Apparently, GitHub treats anything that uses `environment` as a deployment. We have something like 550 deployments at this point, even though we've deployed maybe tens of times, at most.

Refactor the non-deployment workflows to instead use repo-scoped variables/secrets that are prefixed or suffixed with the environment name and map to the desired one using variable string templates.

Coordinate with @jayhill to get the secrets migrated.