Need a better error message when using extensions without `--enable-ext`

**Prerequisites:**

* cwltool 3.2.20260413085819
* I have saved [https://github.com/common-workflow-language/cwltool/blob/8949fc2d68efe128ce841739d1190645dbd233bb/tests/wf/secret_job.cwl](https://github.com/common-workflow-language/cwltool/blob/8949fc2d68efe128ce841739d1190645dbd233bb/tests/wf/secret_job.cwl) as `job.cwl`

**Scenario:**

I run:

```bash
cwltool job.cwl --pw="password"
```

**Current result:**

I’m not sure whether the secrets are being handled correctly, as I see the following warning in the logs:

```
WARNING job.cwl:7:3: Warning: checking item
Warning: Field 'class' contains undefined reference to
'http://commonwl.org/cwltool#Secrets'
```

Thanks.

Start by reviewing tests/wf/secret_job.cwl and reproduce the reported command, cwltool job.cwl --pw="password", to understand the warning when --enable-ext is omitted. Trace where the undefined reference warning is emitted and make the resulting error message clearly explain the required extension setting; done when the scenario gives actionable feedback.

Written by the indexing model from the issue text.