security(qsfs): read owner mnemonic from MNEMONIC env, not a hard-coded const

The qsfs dev script embedded a real sr25519 mnemonic as a package const. Replace it with
`os.Getenv("MNEMONIC")` and fail fast if unset, so no key ships in the source tree. Rotate
the previously-committed key.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ashraffouda

scripts/qsfs/main.go

@@ -47,10 +47,11 @@ const (
 	QSFSCacheSize      = 1 // GB
 
 	SSHKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTwULSsUubOq3VPWL6cdrDvexDmjfznGydFPyaNcn7gAL9lRxwFbCDPMj7MbhNSpxxHV2+/iJPQOTVJu4oc1N7bPP3gBCnF51rPrhTpGCt5pBbTzeyNweanhedkKDsCO2mIEh/92Od5Hg512dX4j7Zw6ipRWYSaepapfyoRnNSriW/s3DH/uewezVtL5EuypMdfNngV/u2KZYWoeiwhrY/yEUykQVUwDysW/xUJNP5o+KSTAvNSJatr3FbuCFuCjBSvageOLHePTeUwu6qjqe+Xs4piF1ByO/6cOJ8bt5Vcx0bAtI8/MPApplUU/JWevsPNApvnA/ntffI+u8DCwgP ashraf@thinkpad"
-
-	Mnemonic = "junior sock chunk accident pilot under ask green endless remove coast wood"
 )
 
+// Mnemonic is the owner twin mnemonic — read from the MNEMONIC env var, never hard-coded.
+var Mnemonic = os.Getenv("MNEMONIC")
+
 // generateWGPrivateKey generates a WireGuard (Curve25519) private key
 func generateWGPrivateKey() string {
 	var key [32]byte
@@ -343,6 +344,10 @@ func main() {
 	enc := json.NewEncoder(os.Stdout)
 	enc.SetIndent("", "  ")
 
+	if Mnemonic == "" {
+		panic("set the MNEMONIC env var (owner twin mnemonic)")
+	}
+
 	identity, err := substrate.NewIdentityFromSr25519Phrase(Mnemonic)
 	if err != nil {
 		panic(err)