feat(reusable): runtime-variable swarm config (cache-immune, no more re-pinning to retune) (#14)

.gitea/workflows/review-reusable.yml

@@ -68,8 +68,8 @@ on:
     # workflow every secret in the caller's repo (registry/deploy/db creds the
     # review never touches). All optional — an unset/unpassed secret resolves to
     # empty, harmless for the providers a given consumer doesn't use. GITEA_TOKEN
-    # is the automatic job token and need not be declared/forwarded. Consumers
-    # with bespoke GADFLY_ENDPOINT_<NAME>s beyond M1/M5 need the full stub.
+    # is the automatic job token and need not be declared/forwarded. Named
+    # endpoints (GADFLY_ENDPOINT_*) come from user/org VARS now, not secrets.
     secrets:
       OLLAMA_CLOUD_API_KEY:    { required: false }
       OPENAI_API_KEY:          { required: false }
@@ -77,8 +77,6 @@ on:
       GOOGLE_API_KEY:          { required: false }
       GADFLY_API_KEY:          { required: false }
       CLAUDE_CODE_OAUTH_TOKEN: { required: false }
-      GADFLY_ENDPOINT_M1:      { required: false }
-      GADFLY_ENDPOINT_M5:      { required: false }
       GADFLY_FINDINGS_URL:     { required: false }
       GADFLY_FINDINGS_TOKEN:   { required: false }
 
@@ -117,11 +115,13 @@ jobs:
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           GADFLY_API_KEY: ${{ secrets.GADFLY_API_KEY }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          # Common named foreman/LAN endpoints (optional). Consumers with other
-          # GADFLY_ENDPOINT_<NAME>s need the full stub (examples/), since a
-          # reusable workflow can't enumerate arbitrary names.
-          GADFLY_ENDPOINT_M1: ${{ secrets.GADFLY_ENDPOINT_M1 }}
-          GADFLY_ENDPOINT_M5: ${{ secrets.GADFLY_ENDPOINT_M5 }}
+          # Named LAN endpoints, defined in user/org vars (format
+          # "<provider>|<base-url>[|<key>]"). Adding a NEW name still needs a line
+          # here — a reusable workflow can't enumerate arbitrary vars.GADFLY_ENDPOINT_*.
+          # NB: vars are NOT masked like secrets — if an endpoint embeds an auth
+          # token, keep that one a secret instead.
+          GADFLY_ENDPOINT_M1: ${{ vars.GADFLY_ENDPOINT_M1 }}
+          GADFLY_ENDPOINT_M5: ${{ vars.GADFLY_ENDPOINT_M5 }}
           # ragnaros = the 4090 Ti via its llama-swap proxy. Defined in the user
           # var GADFLY_ENDPOINT_RAGNAROS (format "<provider>|<base-url>[|<key>]")
           # so the URL can change without editing this file; the matching model is