Let caller-provided skills receive their secrets again

#122 gave the reusable workflow an explicit workflow_call secret contract so
XAI_API_KEY would stop arriving empty. That fixed the model key and quietly
broke every caller-provided skill: SECRETS_JSON is toJSON(secrets), so it now
contains only the secrets this contract declares, and a skill's setup.sh finds
nothing under the names its own repo uses.

homelab's node1-ssh skill is the live casualty. Its setup.sh reads SWARM_HOST,
SWARM_USER and SSH_PRIV_KEY_B64, takes the "not set -- skipping node1 SSH alias"
path, and exits 0; the agent then loads the skill, is told it may run
`ssh node1 ...`, and gets nothing. @senior hit exactly this while diagnosing the
immich crash-loop in homelab #301 and had to fall back to a blind version
revert. The failure is silent by design -- the skip is what lets a fork run
without deploy secrets -- so nothing in the run says the capability is gone.

Declaring the three optional here is the smallest fix that keeps the contract.
It is not a general one: secret names for caller skills are by definition known
only to the caller, and an explicit contract cannot express that, so each new
caller-skill secret has to be added alongside these.

Also fixes two pieces of drift that would spread the same breakage: the header
still told callers to use `secrets: inherit`, and README's copy-me stub still
showed it, so the next repo onboarded would have arrived with no model key.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYFnHida4AdiNDek2pzgXx

README.md

@@ -87,7 +87,12 @@ on:
 jobs:
   agent:
     uses: gitea/agents/.gitea/workflows/agent.yml@main
-    secrets: inherit
+    # Explicit map, not `secrets: inherit`: inherit alone has left XAI_API_KEY empty on some Gitea
+    # cross-owner calls. Copy the full list from .gitea/workflows/ai-agent.yml, which is the stub
+    # this file abbreviates -- a secret missing from the map does not reach the workflow at all.
+    secrets:
+      GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+      # ... and the OLLAMA_*, XAI_API_KEY, TOKEN_* and caller-skill entries, verbatim.
 ```
 
 That's the whole per-repo footprint, and it's the minimum a caller can be: the `on:` triggers must