docs: remove stale GHA executor references

- repo-vars-and-secrets.md: remove 'Later rollout (GHA)' callout block;
  the executor is CodeBuild triggered by webhook, not GitHub Actions
- fleet-governance-at-scale.md: remove 'GHA executor rollout phase' note;
  replace with accurate CodeBuild+webhook description

docs/fleet-governance-at-scale.md

@@ -273,8 +273,8 @@ gives a CSVD engineer a full fleet view in a single editor window:
 on every push to `main`. The script walks `workloads/**/**/main.tf`, extracts `repo_name`
 and `workload_name`, and writes `fleet.code-workspace`. No operator ever edits it manually.
 
-> In the initial rollout this is a CodeBuild project triggered by a webhook. GHA
-> workflows will replace it when the GHA executor rollout phase is complete.
+> In the initial rollout this is a CodeBuild project triggered by a webhook on
+> push to `main` in the `terraform-sc-fleet` repo.
 
 With this workspace open, a CSVD engineer can:
 - See all workload configs side-by-side in the Explorer without navigating repos

docs/repo-vars-and-secrets.md

@@ -12,11 +12,6 @@ injected directly as CodeBuild environment variable overrides at build-start tim
 Store and Secrets Manager values are fetched by the Lambda and passed through, or
 read directly by the CodeBuild buildspec at runtime.
 
-> **Later rollout (GHA):** When GitHub Actions workflows replace CodeBuild as the
-> executor, the mechanism shifts to GitHub Actions secrets and variables set via
-> the GHE API. The SSM/Secrets Manager parameter structure described below is
-> designed to support both models.
-
 ---
 
 ## Overview