Fix secret vars sourced from env, not config copy

create_extra_vars callers pass {**config} copies so linode_token never
landed in the original config dict. Pull provider credentials from the
environment (already set by set_provider_environment) so the temp-file
secret path works regardless of how config was constructed.

utils/deployment_engine.py

@@ -166,9 +166,21 @@ def execute_playbook(playbook, config):
 
         # Write sensitive vars to a temp file (0o600) so they reach Ansible as
         # variables without appearing in process listings or the main extra-vars JSON.
-        secret_vars = {k: v for k, v in config.items()
-                       if v is not None
-                       and any(s in k.lower() for s in _SECRET_KEYS)}
+        # Read from environment (set by set_provider_environment) so this works even
+        # when config was passed as a copy ({**config}) that didn't capture the token.
+        secret_vars = {}
+        if os.environ.get('LINODE_TOKEN'):
+            secret_vars['linode_token'] = os.environ['LINODE_TOKEN']
+        if os.environ.get('AWS_ACCESS_KEY_ID'):
+            secret_vars['aws_access_key'] = os.environ['AWS_ACCESS_KEY_ID']
+        if os.environ.get('AWS_SECRET_ACCESS_KEY'):
+            secret_vars['aws_secret_key'] = os.environ['AWS_SECRET_ACCESS_KEY']
+        if os.environ.get('FLOKINET_API_KEY'):
+            secret_vars['flokinet_api_key'] = os.environ['FLOKINET_API_KEY']
+        # Also pick up any remaining secret keys from config dict (e.g. smtp_auth_pass)
+        for k, v in config.items():
+            if v is not None and k not in secret_vars and any(s in k.lower() for s in _SECRET_KEYS):
+                secret_vars[k] = v
         if secret_vars:
             fd, secret_vars_file = tempfile.mkstemp(suffix='.json', prefix='ansible_secret_')
             os.chmod(secret_vars_file, 0o600)