feat(ops): make @ops routable + post under its own TOKEN_OPS identity

PR #55 added @ops to the registry but route.sh only looped pm/junior/senior/lead/qa, so @ops could
never be triggered, and there was no token case for it. Add 'ops' to the routing loop and the
TOKEN_OPS case in route.sh + publish.sh, and pass TOKEN_OPS in the workflow env next to TOKEN_QA
(route/publish/rescue steps) so route.sh (set -u) doesn't error on an @ops run.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/scripts/publish.sh

@@ -9,7 +9,7 @@ set +e   # publish is best-effort: a grep-no-match / curl non-zero must NOT kill
 # Post/PR as the agent's OWN Gitea user when its token is configured; else the built-in bot.
 case "$NAME" in
   pm) TOK="$TOKEN_PM";; senior) TOK="$TOKEN_SENIOR";; junior) TOK="$TOKEN_JUNIOR";;
-  lead) TOK="$TOKEN_LEAD";; qa) TOK="$TOKEN_QA";; *) TOK="";;
+  lead) TOK="$TOKEN_LEAD";; qa) TOK="$TOKEN_QA";; ops) TOK="$TOKEN_OPS";; *) TOK="";;
 esac
 [ -z "$TOK" ] && TOK="$GT"
 git config user.name  "$NAME"

.gitea/workflows/scripts/route.sh

@@ -27,7 +27,7 @@ cp "$AGENTS_JSON" /tmp/agents.json
 # here — see agent.yml: this reusable workflow sees it as 'workflow_call'.)
 if [ -n "$CID" ]; then scan="$BODY"; else scan="$IBODY"; fi
 name=""
-for a in pm junior senior lead qa; do
+for a in pm junior senior lead qa ops; do
   case "$scan" in *"@$a"*) name=$a; break;; esac
 done
 if [ -z "$name" ]; then
@@ -44,7 +44,7 @@ echo "Routing to @$name (model=$model vision=$vision mode=$mode skills=$skills)"
 # Act as the agent's own Gitea user when its token is set; else the built-in bot.
 case "$name" in
   pm) TOK="$TOKEN_PM";; senior) TOK="$TOKEN_SENIOR";; junior) TOK="$TOKEN_JUNIOR";;
-  lead) TOK="$TOKEN_LEAD";; qa) TOK="$TOKEN_QA";; *) TOK="";;
+  lead) TOK="$TOKEN_LEAD";; qa) TOK="$TOKEN_QA";; ops) TOK="$TOKEN_OPS";; *) TOK="";;
 esac
 [ -z "$TOK" ] && TOK="$GT"
 git config user.name "$name"