fix(builder): drafts don't use CI secrets, and a missing one is fed back

The second Valheim build stopped before its boot test: told that
test.yaml's password "looks like a credential; map it under 'secrets'",
the model mapped it to a CI secret nobody created, and boottest-payload's
missing-secret exit ended the build.

- The validator now says to remove a test password first (boot tests fill
  password settings with a throwaway value); secrets only when the server
  can't start without a real one.
- Drafts with test.yaml 'secrets' fail the draft checks.
- build turns boottest-payload's missing-secret exit into feedback for the
  model instead of an error.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/gbrgames/draft_test.go

@@ -84,3 +84,12 @@ func TestImageUnusable(t *testing.T) {
 		t.Errorf("long run flagged: %q", why)
 	}
 }
+
+func TestDraftCompletenessRejectsSecrets(t *testing.T) {
+	// The Valheim draft that couldn't be boot-tested: the password mapped to a CI secret nobody created
+	test := map[string]any{"settleSec": json.Number("120"), "secrets": map[string]any{"Password": "VALHEIM_TEST_PASSWORD"}}
+	problems := strings.Join(draftCompleteness(map[string]any{}, test), "\n")
+	if !strings.Contains(problems, "test.yaml has 'secrets' (Password)") {
+		t.Errorf("got:\n%s", problems)
+	}
+}