fix(ci): add secrets to reusable workflows

CHANGES
- Add DOCKERHUB_TOKEN secret declaration to auto-update-publish.yml
- Add secrets: inherit to auto-update.yml orchestrator

IMPACT
- Docker Hub authentication now works in reusable workflows

Author: KemingHe

.github/workflows/auto-update-publish.yml

@@ -1,7 +1,10 @@
 name: Publish Image to Docker Hub
 
 on:
-  workflow_call: {}
+  workflow_call:
+    secrets:
+      DOCKERHUB_TOKEN:
+        required: true
   workflow_dispatch: {} # Manual trigger for testing
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/auto-update.yml

@@ -34,3 +34,4 @@ jobs:
       attestations: write  # Required: artifact attestation
       id-token: write      # Required: OIDC token for attestation
     uses: ./.github/workflows/auto-update-publish.yml
+    secrets: inherit       # Required for workflow accessing env secrets