feat(prd-1): implement M2 - Forgejo token handling

- Add src/forgejo/token.ts: synchronous token handler that returns
  OVERRIDE_GITHUB_TOKEN or DEFAULT_WORKFLOW_TOKEN directly (no OIDC)
- Wire platform-aware token setup into run.ts with early branch
  before existing setupGitHubToken() call
- Add test/forgejo-token.test.ts with 8 test cases covering
  override precedence, default fallback, and error handling
- GitHub token path remains completely unchanged

Progress: 22% complete (M1, M2 done) - next: M3 (CI workflows) or M5 (comment URLs)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

test/forgejo-token.test.ts

@@ -0,0 +1,62 @@
+import { setupForgejoToken } from "../src/forgejo/token";
+import { describe, it, expect, beforeEach } from "bun:test";
+
+describe("setupForgejoToken", () => {
+  beforeEach(() => {
+    delete process.env.OVERRIDE_GITHUB_TOKEN;
+    delete process.env.DEFAULT_WORKFLOW_TOKEN;
+  });
+
+  describe("OVERRIDE_GITHUB_TOKEN (user-provided via github_token input)", () => {
+    it("should return OVERRIDE_GITHUB_TOKEN when set", () => {
+      process.env.OVERRIDE_GITHUB_TOKEN = "user-provided-token";
+      expect(setupForgejoToken()).toBe("user-provided-token");
+    });
+
+    it("should take precedence over DEFAULT_WORKFLOW_TOKEN", () => {
+      process.env.OVERRIDE_GITHUB_TOKEN = "override-token";
+      process.env.DEFAULT_WORKFLOW_TOKEN = "default-token";
+      expect(setupForgejoToken()).toBe("override-token");
+    });
+
+    it("should not use empty OVERRIDE_GITHUB_TOKEN", () => {
+      process.env.OVERRIDE_GITHUB_TOKEN = "";
+      process.env.DEFAULT_WORKFLOW_TOKEN = "default-token";
+      expect(setupForgejoToken()).toBe("default-token");
+    });
+  });
+
+  describe("DEFAULT_WORKFLOW_TOKEN (runner's github.token)", () => {
+    it("should return DEFAULT_WORKFLOW_TOKEN when no override is set", () => {
+      process.env.DEFAULT_WORKFLOW_TOKEN = "workflow-token";
+      expect(setupForgejoToken()).toBe("workflow-token");
+    });
+
+    it("should not use empty DEFAULT_WORKFLOW_TOKEN", () => {
+      process.env.DEFAULT_WORKFLOW_TOKEN = "";
+      expect(() => setupForgejoToken()).toThrow(
+        "No authentication token available for Forgejo",
+      );
+    });
+  });
+
+  describe("error handling", () => {
+    it("should throw when no token is available", () => {
+      expect(() => setupForgejoToken()).toThrow(
+        "No authentication token available for Forgejo",
+      );
+    });
+
+    it("should throw when both env vars are empty strings", () => {
+      process.env.OVERRIDE_GITHUB_TOKEN = "";
+      process.env.DEFAULT_WORKFLOW_TOKEN = "";
+      expect(() => setupForgejoToken()).toThrow(
+        "No authentication token available for Forgejo",
+      );
+    });
+
+    it("should include guidance in the error message", () => {
+      expect(() => setupForgejoToken()).toThrow("github_token");
+    });
+  });
+});