fix(agents): declare workflow_call secrets + diagnose empty XAI_API_KEY

Cross-owner reusable calls left XAI_API_KEY empty in the runner while
OLLAMA_CLOUD_API_KEY worked. Declare secrets on workflow_call, accept
alternate secret names, log key lengths (not values), and ship an
ai-agent.yml caller template with an explicit secrets map.

.gitea/workflows/agent.yml

@@ -4,6 +4,31 @@ name: agent
 # The gate + steps run in the caller's event context (github.event.* / github.repository are the caller's).
 on:
   workflow_call:
+    # Explicit secret contract so callers can map secrets by name (more reliable than
+    # secrets: inherit alone on some Gitea versions / cross-owner reusable workflows).
+    secrets:
+      GITEA_TOKEN:
+        required: true
+      OLLAMA_URL:
+        required: false
+      OLLAMA_CLOUD_API_KEY:
+        required: false
+      XAI_API_KEY:
+        required: false
+      TOKEN_PM:
+        required: false
+      TOKEN_SENIOR:
+        required: false
+      TOKEN_JUNIOR:
+        required: false
+      TOKEN_LEAD:
+        required: false
+      TOKEN_QA:
+        required: false
+      TOKEN_OPS:
+        required: false
+      TOKEN_INTERN:
+        required: false
 
 # Pinned opencode version — used to install it and to key the CI cache below.
 env:
@@ -150,7 +175,9 @@ jobs:
           SCRIPTS: ${{ runner.temp }}/agents-scripts
           OLLAMA_URL: ${{ secrets.OLLAMA_URL }}
           OLLAMA_CLOUD_API_KEY: ${{ secrets.OLLAMA_CLOUD_API_KEY }}
-          XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
+          # Accept common alternate names — empty XAI_API_KEY has bitten us when the
+          # secret was stored under a slightly different key on the caller repo.
+          XAI_API_KEY: ${{ secrets.XAI_API_KEY || secrets.XAI_KEY || secrets.GROK_API_KEY || secrets.XAI_TOKEN }}
           NAME: ${{ steps.prep.outputs.name }}
           SKILLS: ${{ steps.prep.outputs.skills }}   # JSON array of skills this agent may load
         run: bash "$SCRIPTS/install-opencode.sh"
@@ -213,7 +240,7 @@ jobs:
         id: run
         env:
           SCRIPTS: ${{ runner.temp }}/agents-scripts
-          XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
+          XAI_API_KEY: ${{ secrets.XAI_API_KEY || secrets.XAI_KEY || secrets.GROK_API_KEY || secrets.XAI_TOKEN }}
           # SELF_TOKEN = the RUNNING agent's OWN token (TOKEN_PM for @pm, TOKEN_OPS for @ops, …).
           # Only this agent's token is placed in its process env, so no agent can act as another.
           # Powers the gitea-api / gitea-admin skills — each agent calls Gitea as itself. Every