fix(ci): give the index writers the metadata database password (#201)

## Why

Pipeline 12207 logs one of these per slot:

```
Error: connection to server at "r-binaries.devxy.io" (116.203.165.191), port 15432 failed:
  fe_sendauth: no password supplied
```

bincraft's index build calls `abi_cache_risky_packages()` to decide which packages may be carried from the flat slot into a per-minor index. `reindex.yaml` and `weekly-rebuild-reindex.yaml` never passed `PGPASS`, so the query cannot connect.

It fails soft by design, which is what makes this worth fixing rather than tolerating: the run still reports **success** while using an empty cache-derived risky set. The index is then written as though no package were known risky from the classifier, which is the exact state the cache was added to fix.

`build-all-versions.yaml` already passes `PGPASS`, which is why classification behaved correctly there and silently degraded here.

## What changed

Adds the `PGPASS` secret to both index-writing workflows, with a comment explaining why its absence is invisible rather than loud.

`crow lint` passes on both files.

## Note

The tarball-derived half of the risky set still worked, so indexes written without this are not wrong so much as incomplete: they miss packages that are known risky from classification but have no per-minor tarball yet. A re-index after this merges applies the full set.

Reviewed-on: #201

.crow/reindex.yaml

@@ -142,6 +142,13 @@ steps:
         from_secret: B2_S3_ACCESS_KEY
       B2_S3_SECRET_KEY:
         from_secret: B2_S3_SECRET_KEY
+      # The index build reads the ABI classifier cache to decide which packages
+      # may be carried from the flat slot into a per-minor one. Without the
+      # password that query fails, and it fails soft, so the run still succeeds
+      # while quietly using an empty risky set: exactly the state the cache was
+      # added to fix. It logs one connection error per slot.
+      PGPASS:
+        from_secret: PGPASS
       REPO_RO_TOKEN:
         from_secret: REPO_RO_TOKEN
       GIT_USER: pat-s

.crow/weekly-rebuild-reindex.yaml

@@ -145,6 +145,13 @@ steps:
         from_secret: B2_S3_ACCESS_KEY
       B2_S3_SECRET_KEY:
         from_secret: B2_S3_SECRET_KEY
+      # The index build reads the ABI classifier cache to decide which packages
+      # may be carried from the flat slot into a per-minor one. Without the
+      # password that query fails, and it fails soft, so the run still succeeds
+      # while quietly using an empty risky set: exactly the state the cache was
+      # added to fix. It logs one connection error per slot.
+      PGPASS:
+        from_secret: PGPASS
       REPO_RO_TOKEN:
         from_secret: REPO_RO_TOKEN
       GIT_USER: pat-s