feat(prd-1): implement M2 - Forgejo token handling

- Add src/forgejo/token.ts: synchronous token handler that returns
  OVERRIDE_GITHUB_TOKEN or DEFAULT_WORKFLOW_TOKEN directly (no OIDC)
- Wire platform-aware token setup into run.ts with early branch
  before existing setupGitHubToken() call
- Add test/forgejo-token.test.ts with 8 test cases covering
  override precedence, default fallback, and error handling
- GitHub token path remains completely unchanged

Progress: 22% complete (M1, M2 done) - next: M3 (CI workflows) or M5 (comment URLs)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/forgejo/token.ts

@@ -0,0 +1,28 @@
+/**
+ * Forgejo token handling.
+ *
+ * Unlike GitHub (which uses OIDC → Anthropic exchange for an app token),
+ * Forgejo uses the runner's workflow token directly. No exchange needed.
+ */
+
+export function setupForgejoToken(): string {
+  // 1. User-provided token (via github_token input → OVERRIDE_GITHUB_TOKEN)
+  const providedToken = process.env.OVERRIDE_GITHUB_TOKEN;
+  if (providedToken) {
+    console.log("Using provided token for Forgejo authentication");
+    return providedToken;
+  }
+
+  // 2. Runner's default workflow token (github.token → DEFAULT_WORKFLOW_TOKEN)
+  const defaultToken = process.env.DEFAULT_WORKFLOW_TOKEN;
+  if (defaultToken) {
+    console.log("Using default workflow token for Forgejo authentication");
+    return defaultToken;
+  }
+
+  throw new Error(
+    "No authentication token available for Forgejo. " +
+      "Provide a token via the 'github_token' input or ensure " +
+      "the workflow has a valid GITHUB_TOKEN.",
+  );
+}