feat(prd-1): implement M2 - Forgejo token handling

- Add src/forgejo/token.ts: synchronous token handler that returns
  OVERRIDE_GITHUB_TOKEN or DEFAULT_WORKFLOW_TOKEN directly (no OIDC)
- Wire platform-aware token setup into run.ts with early branch
  before existing setupGitHubToken() call
- Add test/forgejo-token.test.ts with 8 test cases covering
  override precedence, default fallback, and error handling
- GitHub token path remains completely unchanged

Progress: 22% complete (M1, M2 done) - next: M3 (CI workflows) or M5 (comment URLs)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/entrypoints/run.ts

@@ -12,6 +12,8 @@ import { spawn } from "child_process";
 import { appendFile } from "fs/promises";
 import { existsSync, readFileSync } from "fs";
 import { setupGitHubToken, WorkflowValidationSkipError } from "../github/token";
+import { setupForgejoToken } from "../forgejo/token";
+import { detectPlatform } from "../platform/detector";
 import { checkWritePermissions } from "../github/validation/permissions";
 import { createOctokit } from "../github/api/client";
 import type { Octokits } from "../github/api/client";
@@ -145,15 +147,26 @@ async function run() {
       `Auto-detected mode: ${modeName} for event: ${context.eventName}`,
     );
 
-    try {
-      githubToken = await setupGitHubToken();
-    } catch (error) {
-      if (error instanceof WorkflowValidationSkipError) {
-        core.setOutput("skipped_due_to_workflow_validation_mismatch", "true");
-        console.log("Exiting due to workflow validation skip");
-        return;
+    // Platform-aware token setup
+    const platform = detectPlatform();
+    console.log(`Platform detected: ${platform}`);
+
+    if (platform === "forgejo") {
+      githubToken = setupForgejoToken();
+    } else {
+      try {
+        githubToken = await setupGitHubToken();
+      } catch (error) {
+        if (error instanceof WorkflowValidationSkipError) {
+          core.setOutput(
+            "skipped_due_to_workflow_validation_mismatch",
+            "true",
+          );
+          console.log("Exiting due to workflow validation skip");
+          return;
+        }
+        throw error;
       }
-      throw error;
     }
 
     octokit = createOctokit(githubToken);

src/forgejo/token.ts

@@ -0,0 +1,28 @@
+/**
+ * Forgejo token handling.
+ *
+ * Unlike GitHub (which uses OIDC → Anthropic exchange for an app token),
+ * Forgejo uses the runner's workflow token directly. No exchange needed.
+ */
+
+export function setupForgejoToken(): string {
+  // 1. User-provided token (via github_token input → OVERRIDE_GITHUB_TOKEN)
+  const providedToken = process.env.OVERRIDE_GITHUB_TOKEN;
+  if (providedToken) {
+    console.log("Using provided token for Forgejo authentication");
+    return providedToken;
+  }
+
+  // 2. Runner's default workflow token (github.token → DEFAULT_WORKFLOW_TOKEN)
+  const defaultToken = process.env.DEFAULT_WORKFLOW_TOKEN;
+  if (defaultToken) {
+    console.log("Using default workflow token for Forgejo authentication");
+    return defaultToken;
+  }
+
+  throw new Error(
+    "No authentication token available for Forgejo. " +
+      "Provide a token via the 'github_token' input or ensure " +
+      "the workflow has a valid GITHUB_TOKEN.",
+  );
+}