fix(builder): drafts don't use CI secrets, and a missing one is fed back

The second Valheim build stopped before its boot test: told that
test.yaml's password "looks like a credential; map it under 'secrets'",
the model mapped it to a CI secret nobody created, and boottest-payload's
missing-secret exit ended the build.

- The validator now says to remove a test password first (boot tests fill
  password settings with a throwaway value); secrets only when the server
  can't start without a real one.
- Drafts with test.yaml 'secrets' fail the draft checks.
- build turns boottest-payload's missing-secret exit into feedback for the
  model instead of an error.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/gbrgames/draft.go

@@ -270,6 +270,11 @@ func draftCompleteness(game, test map[string]any) []string {
 	} else if v, _ := n.Int64(); v < 1024 {
 		problems = append(problems, "requiredMemoryMb is below 1024")
 	}
+	// Secrets only exist as CI settings a person adds; a draft with one can't be boot-tested anywhere
+	if secrets, _ := test["secrets"].(map[string]any); len(secrets) > 0 {
+		problems = append(problems, "test.yaml has 'secrets' ("+strings.Join(sortedKeys(secrets), ", ")+"), which no boot test of a "+
+			"new game has: remove them. Password settings get a throwaway value in boot tests automatically")
+	}
 	if _, ok := game["readyPattern"]; !ok {
 		if _, ok := test["settleSec"]; !ok {
 			problems = append(problems, "no readyPattern and no test.settleSec: boot tests need one of them")