Hand the signing secrets to the called release workflow

A workflow invoked with `uses:` gets no secrets unless they are passed to
it, so every secret was empty inside release.yml when tag-on-version-bump
called it. The certificate import was skipped, the build came out ad-hoc,
and the release published that way — the precise outcome signing exists
to prevent.

Its own ad-hoc guard didn't catch it either: that guard only fires when
an identity was configured, and from the called workflow's point of view
none was. So the failure was silent in both places at once, and the run
went green.

Verified against the 0.0.9 build, whose log shows an empty
SIGNING_IDENTITY and Signature=adhoc on the published artifact.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/tag-on-version-bump.yml

@@ -45,5 +45,11 @@ jobs:
     uses: ./.github/workflows/release.yml
     with:
       tag: ${{ needs.tag.outputs.tag }}
+    # A called workflow gets no secrets unless they're handed over, so
+    # without this the signing secrets are empty inside release.yml and it
+    # quietly builds ad-hoc — which is exactly what signing exists to
+    # prevent, and which its own ad-hoc guard misses, since that guard only
+    # fires when an identity was configured.
+    secrets: inherit
     permissions:
       contents: write