Get the tenant's manifest HMAC key

Returns the base64-encoded HMAC-SHA256 key used to sign CI attestation manifests. The key is issued once per tenant. Store it in CI as WRIT_MANIFEST_KEY and pass it to writ scan --manifest-out.