Expose live private-candidate env vars to Pages build

[Copilot]

The live page’s private-candidate reveal button is missing in production because build-time env vars aren’t available. This update wires the required variables into the GitHub Pages build so the client can render the reveal control.

• Workflow configuration
  • Pass NEXT_PUBLIC_LIVE_PRIVATE_CANDIDATES and NEXT_PUBLIC_LIVE_PRIVATE_SECRET_HASH into the build environment for static export.

Example:

- run: bun run build
  env:
    NEXT_PUBLIC_PULSE_API: ${{ vars.PULSE_API_URL }}
    NEXT_PUBLIC_LIVE_PRIVATE_CANDIDATES: ${{ vars.LIVE_PRIVATE_CANDIDATES }}
    NEXT_PUBLIC_LIVE_PRIVATE_SECRET_HASH: ${{ secrets.LIVE_PRIVATE_SECRET_HASH }}