Add environment to claim workflow

Turns out to access environment secrets the workflow must explicitly opt
in to the environment.