docs: clarify real-Drive gate requires the OAuth client secret too

Codex [P2]: the chaos.yml comment said the suite gates on the
"DRIVEN_E2E_* secrets", but DRIVEN_OAUTH_CLIENT_SECRET is also required
by google_e2e.rs's gate and does not match that prefix - a maintainer
could think real Drive coverage ran when omitting it actually disabled
it. List all three required secrets explicitly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UBkoioGf5QscNHccKyhQj2

Author: pmaxhogan

.github/workflows/chaos.yml

@@ -22,12 +22,13 @@ name: Chaos
 #                      (`run-all --fault-injection`).
 #   chaos-real-drive - `v*` TAG pushes ONLY: runs the REAL Google Drive contract
 #                      suite (driven-drive/tests/google_e2e.rs) against a live
-#                      GoogleDriveStore. The suite gates itself on the
-#                      DRIVEN_E2E_* secrets - when they are absent it prints a
-#                      "skipping real-Drive e2e" line and returns Ok (clean skip,
-#                      never red). Real Google traffic on every push/PR is too
-#                      costly, so it runs at release time only. See
-#                      design/E2E_REAL.md.
+#                      GoogleDriveStore. The suite gates itself on three required
+#                      secrets - DRIVEN_E2E_REFRESH_TOKEN, DRIVEN_E2E_DEST_FOLDER_ID
+#                      and DRIVEN_OAUTH_CLIENT_SECRET (CLIENT_ID is optional) - and
+#                      when ANY of them is absent it prints a "skipping real-Drive
+#                      e2e" line and returns Ok (clean skip, never red). Real Google
+#                      traffic on every push/PR is too costly, so it runs at release
+#                      time only. See design/E2E_REAL.md.
 #
 # The long fuzz soak + soak-gated massive-input rows (million-files-nested,
 # tiny-files-100k) run LOCALLY via the justfile (`just chaos-soak`,