fix(ci): authenticate go mod download against the private cad module

Build & Import (run #68) failed: mathias/cad is PRIVATE (unlike
mcp-chassis, the only other internal module a cad-* Dockerfile has fetched
so far, which is public) — 'go mod download' inside the Docker build had
no credential and died on 'terminal prompts disabled'.

Fix mirrors this repo's own existing GIT_ASKPASS pattern (cd.yml's
oathcandidate step, for the private swedsl dependency): a BuildKit secret
mount feeds a GIT_ASKPASS helper for the one RUN that needs it. The token
is never written to a persisted layer — the askpass script and its
reference to /run/secrets/gitea_token are created and removed within the
same RUN instruction. cd.yml writes the token to a file only for
build-image.sh's subprocess and passes it via BUILD_SECRETS (the script's
existing mechanism — 'the caller writes the secret to PATH itself').

Verified by running build-image.sh's actual buildctl invocation locally
against the real koala buildkitd (same daemon CI uses) with a real token —
'go mod download' completes in 1.9s, full build succeeds. Reproduced the
CI failure log before writing this fix, per house discipline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/cd.yml

@@ -146,11 +146,29 @@ jobs:
       # byte-identical copy of mathias/infra's ci-templates/build-image.sh.
       # Do not edit it here -- edit the canonical file, run `task ci:sync`,
       # and infra's drift gate names any repo still carrying an old copy.
+      #
+      # cad-atlas#11: the build now fetches git.d-ma.be/mathias/cad, a
+      # PRIVATE module (unlike mcp-chassis, the only other internal module
+      # any cad-* repo's Dockerfile has fetched so far, which is public) --
+      # `go mod download` inside the Dockerfile needs to authenticate. The
+      # token is written to a file ONLY for the build-image.sh subprocess and
+      # passed as a BuildKit secret (build-image.sh's existing BUILD_SECRETS
+      # mechanism: "the caller writes the secret to PATH itself... a secret
+      # VALUE must never be passed here"), never as a build-arg or env var
+      # that would land in the image or this log.
         env:
           SHA_TAG: ${{ steps.meta.outputs.sha-tag }}
           GIT_SHA: ${{ github.sha }}
           BUILD_ARGS: VERSION=${{ steps.meta.outputs.version }}
-        run: bash .gitea/build-image.sh
+          DMABE_GITEA_API_TOKEN: ${{ secrets.DMABE_GITEA_API_TOKEN }}
+        run: |
+          set -euo pipefail
+          TOKEN_FILE=$(mktemp)
+          printf '%s' "$DMABE_GITEA_API_TOKEN" > "$TOKEN_FILE"
+          chmod 600 "$TOKEN_FILE"
+          export BUILD_SECRETS="id=gitea_token,src=${TOKEN_FILE}"
+          bash .gitea/build-image.sh
+          shred -u "$TOKEN_FILE"
 
   deploy:
     name: Deploy via GitOps