Upgrade to 1.0.0-rc894

Concerns: pushword/flat

Configure read-only snapshot access

Content snapshots can now be downloaded without a Pushword user. Sites that need this access should set pushword_flat.content_snapshot_key to an environment-backed secret; existing editor Bearer tokens continue to work. See the Flat documentation.