fix: Pass secrets explicitly in canary workflow
The release workflow now requires explicit secrets declarations.
Update the canary caller to pass them explicitly instead of using
`secrets: inherit`, which is also more secure as it only passes
the required secrets rather than all repository secrets.
