fix(security): restrict live CI credentials to protected main (#2405)