Split Jupiter swap into build (fetch-only) and sign (key-only) scripts

The runtime blocks any script that reads the treasury secret key AND makes a raw fetch/axios/http call, even for a legitimate Jupiter swap (quote+swap endpoints require fetch, signing requires the key). Fix: split into two script runs.