siren-json.hs has a hackage environment holding HACKAGE_TOKEN

## Summary

Add a `hackage` deployment environment to `siren-json.hs` in the
Terraform-managed repository config, holding `HACKAGE_TOKEN` as an environment
secret, so its release workflow can authenticate to Hackage.

## Motivation

alunduil/siren-json.hs#143 adds `.github/workflows/release.yml`, whose
`candidate` and `publish` jobs both declare `environment: hackage` and read
`secrets.HACKAGE_TOKEN`. Neither the environment nor the secret exists on that
repo, so both jobs fail at the upload step with an empty token. The workflow
cannot be exercised at all until this lands, which also blocks the 1.0.0.0
release it was written for (alunduil/siren-json.hs#69).

`collection-json.hs` already carries `environments = ["hackage"]` (noted in
#212), so this is existing provisioning applied to a second Haskell repo rather
than new module capability.

The token has to be freshly minted. The Cloud Build credentials cannot be
carried over — the only version of the KMS key that encrypted
`cabal.config.enc` is `DESTROYED` (that cleanup is #393). Generate a new one
under "Edit auth tokens" on the Hackage account management page.

## Scope

- Add `hackage` to the `environments` of the `siren_json_hs` caller.
- Provision `HACKAGE_TOKEN` as an environment secret out of band.
- Settle the secret name across repos. #10 specifies `HACKAGE_API_KEY`, but the
`siren-json.hs` and `collection-json.hs` workflows both read `HACKAGE_TOKEN`.
One name should win, and the archetype should match whatever the workflows
read.

## Acceptance criteria

- [ ] `siren-json.hs` has a `hackage` environment.
- [ ] `HACKAGE_TOKEN` exists on it as an environment secret, holding a freshly
generated token.
- [ ] `terraform plan` shows the environment added with no unrelated drift.
- [ ] The `candidate` job in alunduil/siren-json.hs#143 authenticates and
uploads.

## Additional context

- Narrower than #10, which provisions this environment plus required status
checks across all three Haskell repos and depends on #8. This is the
single-repo slice that unblocks alunduil/siren-json.hs#143 now. #10 also
assumes haskell-ci job names and a tag-driven publish; `siren-json.hs` has
since moved to its own `ci.yml` and to a publish keyed on a `version:` change
merged to `main`, so its required-checks half needs rewriting independently.
- #212 changes `environments` from `set(string)` to an object type carrying
reviewers. If that lands first, use the new shape. A required reviewer is not
wanted here — the `publish` job is already gated behind a manual
`workflow_dispatch`, and a reviewer would add a second approval to every
release.
- If a deployment policy is added, note that `siren-json.hs` releases are not
tag-triggered, so the analogue of collection-json.hs#260's `v*` tag rule is a
branch rule limiting the environment to `main`.
- KMS cleanup for the retired Cloud Build path is #393.