login dns/http: accept the private key from an environment variable or a file, not only --private-key #1704

mcp-publisher login dns and login http take the in-process signing key only as --private-key <hex>. In CI that puts the raw key in the process's arguments for as long as the login runs, where other processes on the host can read it (ps, /proc/<pid>/cmdline). GitHub Actions masks the secret in the log, but not in argv.

What we checked, at v1.8.1:

• cmd/publisher/commands/login.go:128 registers private-key as a plain string flag, and NewInProcessSigner (cmd/publisher/auth/common.go:49) gets that string.
• We found no os.Getenv, LookupEnv, file read or stdin read for the key in commands/login.go, auth/common.go, auth/dns.go, auth/http.go or main.go.
• The documented ways to avoid handing over the raw key are cloud signing (Google KMS, Azure Key Vault). That is a much larger step for a project that only wants the key out of argv.

Request. Accept the key without putting it on the command line, for example:

• --private-key-file PATH, with - meaning stdin, and/or
• an environment variable such as MCP_PUBLISHER_PRIVATE_KEY, read when --private-key is absent.

Either would let the GitHub Actions example in docs/modelcontextprotocol-io/github-actions.mdx pass secrets.MCP_PRIVATE_KEY through env: instead of interpolating it into the command line.

Related: #845, on the CLI experience for DNS and HTTP auth, and #1505, on hardening that documented workflow.

For context: we publish dev.digline/digline-mcp from a release workflow with login http, and for now we accept the argv exposure because the runner lasts for one job.