fix(builder): drafts don't use CI secrets, and a missing one is fed back

The second Valheim build stopped before its boot test: told that
test.yaml's password "looks like a credential; map it under 'secrets'",
the model mapped it to a CI secret nobody created, and boottest-payload's
missing-secret exit ended the build.

- The validator now says to remove a test password first (boot tests fill
  password settings with a throwaway value); secrets only when the server
  can't start without a real one.
- Drafts with test.yaml 'secrets' fail the draft checks.
- build turns boottest-payload's missing-secret exit into feedback for the
  model instead of an error.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/gbrgames/validate.go

@@ -168,7 +168,8 @@ func validateGame(dir, folder string, gameSchema, testSchema *jsonschema.Schema)
 			add("test.yaml config.%s is not a key of this game", key)
 		}
 		if sensitiveKey.MatchString(key) {
-			add("test.yaml config.%s looks like a credential; map it under 'secrets' to a Gitea secret instead", key)
+			add("test.yaml config.%s looks like a credential; remove it (boot tests fill password settings with a throwaway "+
+				"value), or, only if the server can't start without a real one, map it under 'secrets' to a CI secret", key)
 		}
 	}
 	for _, key := range sortedKeys(secrets) {