docs: BUGBOT.md rule — a secretless code-quality caller is correct (backend#1526)

[LukasWodka]

Summary

Fleet half of the RFC-BACKEND-1405 Q5 unwind (tracebloc/backend#1526). Q5 was answered 2026-08-04 via tracebloc/rfcs#11: the shared code-quality.yml reusable references no secrets by contract, so secretless callees carry no secrets: line at all — and if the reusable ever gains a secret, callers switch to explicit per-secret passing, never secrets: inherit.

• .cursor/BUGBOT.md — appended one bullet as the last item of the "Known non-issues — do not flag" section: a code-quality-caller.yml that passes no secrets: line is correct, not an omission; Bugbot should instead flag the addition of secrets: inherit on this caller. No other lines touched.

This repo's code-quality-caller.yml is already secretless on develop, so no workflow change is needed here.

Part of tracebloc/backend#1526

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only change to .cursor/BUGBOT.md with no runtime or CI behavior changes.

Overview
Documents RFC-BACKEND-1405 Q5 (backend#1526) for automated review: a code-quality-caller.yml with no secrets: block is correct because the shared code-quality.yml reusable does not use secrets.

The new Known non-issues bullet tells Bugbot not to flag a missing secrets: line as an omission, and to flag secrets: inherit if someone adds it on this caller. Callers should use explicit per-secret passing if the reusable ever needs secrets.

No workflow edits in this PR—the repo’s caller is already secretless on develop.

^{Reviewed by Cursor Bugbot for commit f7004cf. Bugbot is set up for automated code reviews on this repo. Configure here.}