feat(prd-1): implement M2 - Forgejo token handling

- Add src/forgejo/token.ts: synchronous token handler that returns
  OVERRIDE_GITHUB_TOKEN or DEFAULT_WORKFLOW_TOKEN directly (no OIDC)
- Wire platform-aware token setup into run.ts with early branch
  before existing setupGitHubToken() call
- Add test/forgejo-token.test.ts with 8 test cases covering
  override precedence, default fallback, and error handling
- GitHub token path remains completely unchanged

Progress: 22% complete (M1, M2 done) - next: M3 (CI workflows) or M5 (comment URLs)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

prds/1-forgejo-platform-support.md

@@ -232,7 +232,7 @@ The upstream repo has 13 workflows in `.github/workflows/`. Strategy:
   - Files: `action.yml` (MODIFIED), `src/platform/detector.ts` (NEW)
   - Success: `detectPlatform()` returns "forgejo" in Forgejo runner, "github" in GitHub runner. `action.yml` doesn't error on Forgejo.
 
-- [ ] **M2: Forgejo token handling** — Create `src/forgejo/token.ts` that returns `GITHUB_TOKEN` / `FORGEJO_TOKEN` directly (no OIDC, no Anthropic exchange). Wire into `run.ts` with an early platform branch before the existing `setupGitHubToken()` call.
+- [x] **M2: Forgejo token handling** — Create `src/forgejo/token.ts` that returns `GITHUB_TOKEN` / `FORGEJO_TOKEN` directly (no OIDC, no Anthropic exchange). Wire into `run.ts` with an early platform branch before the existing `setupGitHubToken()` call.
   - Files: `src/forgejo/token.ts` (NEW), `src/entrypoints/run.ts` (MODIFIED — surgical addition at top of `run()`)
   - Depends on: M1
   - Success: Token is available without OIDC on Forgejo. GitHub path unchanged.