@senior: issue #17 — live agent capability table via Gitea 1.27 /api/v1/token

skill-gitea-api.sh now introspects each agent's own PAT (AGENT_TOKEN +
TOKEN_PM/SENIOR/JUNIOR/LEAD/QA) via GET /api/v1/token — a Gitea 1.27+
self-introspection endpoint (token-in, scopes-out, no password) — and bakes a
live, always-accurate 'who can do what' matrix into SKILL.md. Every agent that
loads gitea-api sees every teammate's real scopes; no hand-maintained table to
drift when scopes rotate. Falls back to a static note on <1.27 or unset tokens.

agent.yml passes GITHUB_SERVER_URL + the per-agent TOKEN_* secrets into the
gitea-api skill step so the script can introspect them. run-agent.sh adds a
roster note pointing agents to the matrix for capability-based routing.

Least-privilege gating (plan point #3) was already done in issue #22 via
agents.json skills arrays + install-opencode.sh permission.skill scoping, so
no redundant case gates are added here.

.gitea/workflows/scripts/run-agent.sh

@@ -68,6 +68,9 @@ PROMPT="You are @${NAME}, a member of an AI dev team working on this Gitea repos
 
    TEAM ROSTER (who does what — hand off if a task isn't yours):
    ${ROSTER}
+   The `gitea-api` skill carries a LIVE Agent Capability Matrix (auto-introspected at
+   workflow start via GET /api/v1/token) listing every teammate's real Gitea scopes —
+   load that skill if you need to route by what an agent can actually do on Gitea.
 
    ${ACTION}
    If a task needs expertise or a capability you lack, do NOT guess — say which