chore: trigger CI for SOP gate re-check

Add missing database/sql row-scan error checks to
workspace-server/internal/handlers/secrets.go following the Go
database/sql pattern (rows.Err() must be checked after every
for rows.Next() loop). Fixes 6 loops:

- List: for rows.Next() (workspace secrets)
- List: for globalRows.Next() (merged global secrets)
- Values: for globalRows.Next() (decrypted global secrets)
- Values: for wsRows.Next() (decrypted workspace secrets)
- ListGlobal: for rows.Next()
- restartAllAffectedByGlobalKey: for rows.Next()

Each check logs the error and returns, consistent with the error
handling posture elsewhere in this file.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

workspace-server/internal/handlers/secrets.go

@@ -63,6 +63,10 @@ func (h *SecretsHandler) List(c *gin.Context) {
 			"updated_at": updatedAt,
 		})
 	}
+	if err := rows.Err(); err != nil {
+		log.Printf("database scan error: %v", err)
+		return
+	}
 
 	// 2. Global secrets not overridden at workspace level
 	globalRows, err := db.DB.QueryContext(ctx,
@@ -91,6 +95,10 @@ func (h *SecretsHandler) List(c *gin.Context) {
 			"updated_at": updatedAt,
 		})
 	}
+	if err := globalRows.Err(); err != nil {
+		log.Printf("database scan error: %v", err)
+		return
+	}
 
 	c.JSON(http.StatusOK, secrets)
 }
@@ -174,6 +182,10 @@ func (h *SecretsHandler) Values(c *gin.Context) {
 				out[k] = string(decrypted)
 			}
 		}
+	if err := globalRows.Err(); err != nil {
+		log.Printf("database scan error: %v", err)
+		return
+	}
 	}
 
 	wsRows, wErr := db.DB.QueryContext(ctx,
@@ -195,6 +207,10 @@ func (h *SecretsHandler) Values(c *gin.Context) {
 				out[k] = string(decrypted) // workspace override wins over global
 			}
 		}
+	if err := wsRows.Err(); err != nil {
+		log.Printf("database scan error: %v", err)
+		return
+	}
 	}
 
 	if len(failedKeys) > 0 {
@@ -324,6 +340,10 @@ func (h *SecretsHandler) ListGlobal(c *gin.Context) {
 			"scope":      "global",
 		})
 	}
+	if err := rows.Err(); err != nil {
+		log.Printf("database scan error: %v", err)
+		return
+	}
 	c.JSON(http.StatusOK, secrets)
 }
 
@@ -400,6 +420,10 @@ func (h *SecretsHandler) restartAllAffectedByGlobalKey(key string) {
 			ids = append(ids, id)
 		}
 	}
+	if err := rows.Err(); err != nil {
+		log.Printf("database scan error: %v", err)
+		return
+	}
 	if len(ids) == 0 {
 		return
 	}