feat(ops): add @ops agent — Gitea instance administrator

A comment-mode operator agent (opus) for administering Gitea itself from issues in gitea/ops:
create orgs/users/repos, manage labels & Actions secrets, and mint least-privilege per-user tokens.

- agents.json: new @ops role (comment-mode, skill gitea-admin, confirms before destructive ops).
- skill-gitea-admin.sh: SKILL.md documenting org/user/repo/label/secret ops + the create-user →
  mint-scoped-token → store-as-secret flow (never printing tokens). Gated on NAME=ops so the admin
  how-to is written ONLY for @ops; permission.skill also denies it to other agents.
- agent.yml: wire the skill step (uses AGENT_TOKEN — an admin PAT during bootstrap).

Bootstrap note: AGENT_TOKEN is admin for now, so every agent's process technically holds an admin
credential (skill-scoping hides the doc, not the env var). Once @ops is minting scoped per-user
tokens, narrow AGENT_TOKEN and inject a dedicated admin token only for @ops.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/agent.yml

@@ -131,6 +131,17 @@ jobs:
           AGENT_TOKEN: ${{ secrets.AGENT_TOKEN }}
         run: bash "$SCRIPTS/skill-gitea-api.sh"
 
+      - name: Set up `gitea-admin` skill (@ops only — administer the Gitea instance)
+        # Instance administration (orgs/users/repos/labels/secrets/scoped tokens). The SKILL.md is
+        # written ONLY for @ops (skill-gitea-admin.sh gates on NAME), so the admin how-to never
+        # reaches other agents; permission.skill also denies it to everyone but @ops. Uses
+        # AGENT_TOKEN (an admin PAT during bootstrap) — see the script header for the token plan.
+        env:
+          SCRIPTS: ${{ runner.temp }}/agents-scripts
+          NAME: ${{ steps.prep.outputs.name }}
+          AGENT_TOKEN: ${{ secrets.AGENT_TOKEN }}
+        run: bash "$SCRIPTS/skill-gitea-admin.sh"
+
       - name: Inspect / fetch image attachments (download only for vision agents)
         id: imgs
         env: