Publish to a Telesphorepo artifact repository with short-lived, per-publish credentials minted from an enrolled device key or a CI OIDC token (GitHub Actions, Jenkins). No long-lived passwords in builds or CI.