feat: declare workflow_call secrets explicitly

[vklimontovich]

Adds explicit secrets: declaration to on.workflow_call so callers can pass
specific secrets instead of relying on secrets: inherit.

Declares:

• OPENAI_API_KEY (required)
• AI_CODE_REVIEW_APP_ID (optional)
• AI_CODE_REVIEW_PRIVATE_KEY (optional)

After merging, dispatch the release.yml workflow to generate a new tag.

[vklimontovich]

Looks good

[jitsu-code-review]

Looks good. Declaring secrets here aligns the reusable-workflow contract with how this workflow already consumes and optional app credentials, and I don’t see correctness or security regressions in this change.

[jitsu-code-review]

No additional concerns found after full diff validation. The new workflow_call secrets declaration is consistent with current secret usage and improves reusable-workflow correctness.