feat(ci-infra): block unverifiable secrets on every pull request (#1282)