config OE_WILDMETA_BACKEND_ECDSA_PUBKEY through github secret (#3679)

* looks like `passthrough` works fine.

* load OE_WILDMETA_BACKEND_ECDSA_PUBKEY from github secret.

Author: BillyWooo

.github/workflows/create-release-draft.yml

@@ -260,6 +260,7 @@ jobs:
         uses: docker/build-push-action@v6
         env:
           DOCKER_BUILD_RECORD_UPLOAD: false
+          OE_WILDMETA_BACKEND_ECDSA_PUBKEY: ${{ secrets.OE_WILDMETA_BACKEND_ECDSA_PUBKEY }}
         with:
           context: .
           file: tee-worker/omni-executor/Dockerfile

tee-worker/omni-executor/omni-executor.manifest.template

@@ -87,7 +87,7 @@ loader.env.OE_HYPEREVM_TESTNET_URL = { passthrough = true }
 loader.env.OE_OMNI_FACTORY_ADDRESS = { passthrough = true }
 loader.env.OE_ENTRY_POINT_ADDRESS = { passthrough = true }
 loader.env.OE_WILDMETA_API_URL = { passthrough = true }
-loader.env.OE_WILDMETA_BACKEND_ECDSA_PUBKEY = "{{ env.get('WILDMETA_BACKEND_ECDSA_PUBKEY', '020000000000000000000000000000000000000000000000000000000000000000') }}"
+loader.env.OE_WILDMETA_BACKEND_ECDSA_PUBKEY = "{{ env.get('OE_WILDMETA_BACKEND_ECDSA_PUBKEY', '020000000000000000000000000000000000000000000000000000000000000000') }}"
 
 # This key is a workaround because gramine-direct doesn't provide _sgx_mrsigner key
 {{'' if env.get('SGX', '0') == '1' else 'fs.insecure__keys.fake_sgx_mrsigner = "ffeeddccbbaa99887766554433221100"'}}