agents: remove shared AGENT_TOKEN fallback — per-agent tokens only

All three consuming repos (gitea/agents, gitea/ops, ffaerber/homelab) now
carry the per-agent TOKEN_* secrets (org-level for gitea/*, user-level for
ffaerber/*), so the shared AGENT_TOKEN fallback is no longer needed.

- agent.yml: SELF_TOKEN ternary ends in '' instead of secrets.AGENT_TOKEN;
  removed AGENT_TOKEN from the publish + rescue step env.
- publish.sh: TTOK is just the agent's own token; if an agent somehow has none
  (TOK fell back to the built-in GT), TTOK is left empty so the trigger/merge
  is skipped rather than silently no-op'ing under the built-in token.
- README: drop the AGENT_TOKEN row; state that every consuming repo must carry
  the per-agent TOKEN_* (no shared fallback).

The AGENT_TOKEN Actions secrets (org + user) and its gitea/secrets/.env entry
are removed separately.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/scripts/publish.sh

@@ -13,10 +13,12 @@ case "$NAME" in
 esac
 [ -z "$TOK" ] && TOK="$GT"
 # Trigger token: comments that must FIRE the next workflow (delegation, autopilot) and PR merges
-# cannot use the built-in GITEA_TOKEN (Gitea won't start new runs from it). Use the agent's own PAT
-# when it has one; otherwise fall back to AGENT_TOKEN (repos without per-agent tokens, e.g. homelab).
+# cannot use the built-in GITEA_TOKEN (Gitea won't start new runs from it) — they need a real PAT.
+# Every agent now has its own token, so TTOK is just the agent's token. If an agent somehow has none
+# (TOK fell back to the built-in GT), TTOK is left empty so the trigger/merge is skipped rather than
+# silently no-op'ing under the built-in token.
 TTOK="$TOK"
-{ [ -z "$TTOK" ] || [ "$TTOK" = "$GT" ]; } && TTOK="${AGENT_TOKEN:-}"
+[ "$TTOK" = "$GT" ] && TTOK=""
 git config user.name  "$NAME"
 git config user.email "$NAME@ffaerber.duckdns.org"
 API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"