CI: pass no secrets to the org reusables

[07-C9]

The psd-ci and license-check callers pass secrets: inherit to the org reusables. Neither reusable-psd-ci.yml nor reusable-license-check.yml declares or reads a secret, so the line only hands those jobs every org and repo secret, and every repo made from this template copies it. This removes the line from both callers.

Tested before this PR: psd401/psd-dev-standards#102 (license-check without secrets, passed) and psd401/psd-crowdstrike-infra#3 (psd-ci and license-check without secrets, passed). The same line is in 44 workflow files across 23 repos (psd401/psd-dev-standards#101); the templates are where new repos pick it up.

[claude]

Review: CI: pass no secrets to the org reusables

Findings: none. The diff is clean.

What I read

• The diff removes secrets: inherit from .github/workflows/psd-ci.yml:11 and .github/workflows/license-check.yml:9. No other lines change.
• PSD401/.github reusable-psd-ci.yml has no secrets. reference. Its only secret-matching text is the gitleaks warning string. The gitleaks binary is downloaded and run directly, with no license key or token passed in.
• reusable-license-check.yml has no secrets. reference either. Its ${{ }} expressions only read inputs.*.
• Both reusables read GITHUB_TOKEN implicitly, which secrets: inherit does not affect, so the removal does not change token scope.

Security and data handling: the change reduces secret exposure to the two jobs. It touches no student data, logs, or external services.

CI gates: no tests removed, skipped, or weakened. Both jobs still run on the same triggers.

I did not run the workflows. The reusable-workflow check was done by reading the files via gh api, not by executing CI.