ops: add isolated ASR deployment and safe GPU test handoff

deployment/followup-audio-asr/init-env.py

@@ -0,0 +1,14 @@
+#!/usr/bin/env python3
+"""Create a new local secret without displaying it; never replace existing .env."""
+import os
+from pathlib import Path
+import re
+import secrets
+root=Path(__file__).resolve().parent
+image=(root/'image-id.txt').read_text().strip()
+assert re.fullmatch(r'sha256:[0-9a-f]{64}', image), 'Invalid immutable image ID'
+path=root/'.env'
+fd=os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+with os.fdopen(fd,'w') as stream:
+    stream.write(f'ASR_IMAGE={image}\nASR_API_KEY={secrets.token_urlsafe(48)}\nASR_GPU_MEMORY_UTILIZATION=0.15\n')
+print('ENV_CREATED mode=0600 secret=not-displayed image='+image)