fix(scripts): name the aws profile that actually holds the Hetzner keypair

import-cluster-access.sh hardcoded AWS_PROFILE="secrets". No such profile
exists on the workstation; the one holding the Hetzner Object Storage keypair
is "hetzner". The failure this produced is worse than a missing profile
usually is:

    fatal error: An error occurred (403) when calling the HeadObject
    operation: Forbidden

which reads as a permissions problem on the bucket, and sends you looking at
bucket policy rather than at a profile that was never there.

`${AWS_PROFILE:-hetzner}` rather than a second hardcoded name, so a caller can
override it — the header has always documented env credentials as an equally
valid path, and the unconditional export silently defeated that.

Found while restoring ~/.kube/config and ~/.talos/config after the hcloudtest
phase overwrote them (fixed in 174e0862). Verified end to end: both files
restored, and the real cluster answers with all three control planes.

scripts/import-cluster-access.sh

@@ -13,7 +13,13 @@ set -euo pipefail
 ENDPOINT="https://fsn1.your-objectstorage.com"
 BUCKET="renner-uno-k8s-secrets"
 PREFIX="cluster-access"
-export AWS_PROFILE="secrets"
+# The profile holding the Hetzner Object Storage keypair. Named, not assumed:
+# this used to hardcode "secrets", which does not exist on the workstation, so
+# the script failed with a bare `403 Forbidden` from HeadObject — an error that
+# reads like a permissions problem on the bucket rather than a profile that was
+# never there. `:-` so a caller can still override it, which the hardcoded
+# version silently prevented.
+export AWS_PROFILE="${AWS_PROFILE:-hetzner}"
 
 
 command -v aws >/dev/null  || { echo "aws-cli not found"; exit 1; }