The branch-scoped tag workflow could no longer release anything. It
calls the reusable engine release workflow without the two bot secrets,
and that workflow began declaring them required when bump-refs was
added, so the call is invalid and the next tag cut from this branch
would fail before building. Earlier tags succeeded because a tag push
runs the definition present at the tagged commit, and those commits
predated the requirement.

Passing the secrets in would be the wrong fix: these are debug images
built without merging, so the bot must not announce them or move any
stable reference. Gate bump-refs on an explicit BUMP_REFS input instead,
defaulting to true so the real release path is untouched, and make the
two bot secrets optional since that job is their only consumer. The tag
workflow passes false and keeps omitting them.

An explicit input beats inferring intent from whether a secret happens
to be present, and it stays separate from IS_PRERELEASE: a debug tag is
not a prerelease, even though both end up skipping the same job.

actionlint now passes on both workflows.

Addresses review finding build-ci-docs_01.