fix(ci): use from_secret syntax instead of deprecated secrets field

Woodpecker v2 requires `from_secret` inside the environment block.
The top-level `secrets` key is deprecated and rejected by the linter.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.woodpecker/ci.yml

@@ -6,8 +6,8 @@ when:
   - event: [push, pull_request, manual]
 
 # Turbo remote cache is at turbo.mosaicstack.dev (ducktors/turborepo-remote-cache).
-# TURBO_TOKEN is set as a Woodpecker secret. Turbo picks up TURBO_API, TURBO_TOKEN,
-# and TURBO_TEAM from the environment automatically.
+# TURBO_TOKEN is a Woodpecker secret injected via from_secret into the environment.
+# Turbo picks up TURBO_API, TURBO_TOKEN, and TURBO_TEAM automatically.
 
 steps:
   install:
@@ -21,7 +21,8 @@ steps:
     environment:
       TURBO_API: https://turbo.mosaicstack.dev
       TURBO_TEAM: mosaic
-    secrets: [turbo_token]
+      TURBO_TOKEN:
+        from_secret: turbo_token
     commands:
       - *enable_pnpm
       - pnpm typecheck
@@ -34,7 +35,8 @@ steps:
     environment:
       TURBO_API: https://turbo.mosaicstack.dev
       TURBO_TEAM: mosaic
-    secrets: [turbo_token]
+      TURBO_TOKEN:
+        from_secret: turbo_token
     commands:
       - *enable_pnpm
       - pnpm lint
@@ -54,7 +56,8 @@ steps:
     environment:
       TURBO_API: https://turbo.mosaicstack.dev
       TURBO_TEAM: mosaic
-    secrets: [turbo_token]
+      TURBO_TOKEN:
+        from_secret: turbo_token
     commands:
       - *enable_pnpm
       - pnpm test
@@ -66,7 +69,8 @@ steps:
     environment:
       TURBO_API: https://turbo.mosaicstack.dev
       TURBO_TEAM: mosaic
-    secrets: [turbo_token]
+      TURBO_TOKEN:
+        from_secret: turbo_token
     commands:
       - *enable_pnpm
       - pnpm build