fix: make secrets inherit an explicit opt-in instead of the default

[joshua-temple]

Problem

The generator emitted secrets: inherit for every reusable, cross-repo deploy, rollback, callback, and hotfix-build job whenever the manifest secrets field was unset. That insecure default handed every caller secret to each called workflow, including external ones, with no opt-in.

Fix

Make secrets: inherit an explicit opt-in.

• New default: when the manifest secrets field is unset, no secrets: block is emitted. The called workflow receives only its own GITHUB_TOKEN.
• inherit remains available as an explicit opt-in, via the scalar secrets: inherit or the mapping secrets: { inherit: true }. Mapping support for inherit: true was added; the scalar form is unchanged.
• The explicit per-secret map form (secrets: { CALLED: CALLER }) is unchanged.
• UnmarshalYAML accepts the scalar inherit, { inherit: true }, a secret-name mapping, and bare/null (unset), and rejects a mapping that mixes inherit with secret-name keys.
• writeSecretsBlock now owns the terminating blank line in all paths, including the no-op case, so job separation stays valid. The hotfix build job, which previously hardcoded secrets: inherit, now routes through writeSecretsBlock and honors the same opt-in.

There are no external consumers of generated workflows (only the test fleet), so this behavioral default change is safe.

Stacking

This PR is stacked on #152 (feat/deploy-image-digest); its base is that branch so the diff shows only this change. The two share the deploy-job generation code and e2e fixtures, so sequencing them avoids conflicts. Rebase onto main once #152 merges (or merge #152 first).

Verification

• go build ./... && go test ./...: all unit tests pass.
• e2e module: go build, go vet, golangci-lint run ./... clean (both modules).
• New e2e scenarios under e2e/scenarios/orchestrate/: secrets-default-none asserts no secrets: block is generated by default; secrets-opt-in asserts the scalar, mapping, and per-secret forms. Local runs with Docker:
  ```
  --- PASS: TestMultiStepScenarios (0.01s)
  ok github.com/stablekernel/cascade/e2e 20.798s
  ```
• Representative deploy, promote, and orchestrate scenarios (cascade-promotion, source-image-tag, env-gates) also pass under act:
  ```
  ok github.com/stablekernel/cascade/e2e 84.618s
  ```