rainix-copy-artifacts: declare the CACHIX_AUTH_TOKEN contract so consumers can drop secrets: inherit

[thedavidmeister]

.github/workflows/rainix-copy-artifacts.yaml is:

on:
  workflow_call:

with no secrets: block, while line 15 uses secrets.CACHIX_AUTH_TOKEN.

With workflow_call and no declared secrets, the only way the reusable can see that token is secrets: inherit from the caller — which hands it every repository secret rather than the one it needs. All sixteen consumers do exactly that, because there is nothing else they can do.

Declare the contract:

on:
  workflow_call:
    secrets:
      CACHIX_AUTH_TOKEN:
        required: true

Consumers can then pass that one secret explicitly. Ordered: rainix first, consumers after, or their mapping references a contract that does not exist.

Raised by CodeRabbit against rainlanguage/rain.extrospection.deploy#8, where it cannot be fixed.