ops: .env is the token source of truth (not tokens.md)

Every token value must be written to gitea/secrets/.env (the master, mirrored to org Actions secrets)
AND the Actions secret, kept in sync, removed from both on delete. Drop the tokens.md instruction —
the @ops test dutifully re-created tokens.md because the skill still referenced it.

.gitea/workflows/agent.yml

@@ -92,6 +92,7 @@ jobs:
           TOKEN_JUNIOR: ${{ secrets.TOKEN_JUNIOR }}
           TOKEN_LEAD: ${{ secrets.TOKEN_LEAD }}
           TOKEN_QA: ${{ secrets.TOKEN_QA }}
+          TOKEN_OPS: ${{ secrets.TOKEN_OPS }}
         run: bash "$SCRIPTS/route.sh"
 
       - name: Install opencode + provider config (+ Playwright MCP for browser agents)
@@ -198,6 +199,7 @@ jobs:
           TOKEN_JUNIOR: ${{ secrets.TOKEN_JUNIOR }}
           TOKEN_LEAD: ${{ secrets.TOKEN_LEAD }}
           TOKEN_QA: ${{ secrets.TOKEN_QA }}
+          TOKEN_OPS: ${{ secrets.TOKEN_OPS }}
           NAME: ${{ steps.prep.outputs.name }}
           MODE: ${{ steps.prep.outputs.mode }}
           NUM: ${{ github.event.issue.number }}
@@ -223,6 +225,7 @@ jobs:
           TOKEN_JUNIOR: ${{ secrets.TOKEN_JUNIOR }}
           TOKEN_LEAD: ${{ secrets.TOKEN_LEAD }}
           TOKEN_QA: ${{ secrets.TOKEN_QA }}
+          TOKEN_OPS: ${{ secrets.TOKEN_OPS }}
           NAME: ${{ steps.prep.outputs.name }}
           MODE: ${{ steps.prep.outputs.mode }}
           NUM: ${{ github.event.issue.number }}

.gitea/workflows/scripts/publish.sh

@@ -9,7 +9,7 @@ set +e   # publish is best-effort: a grep-no-match / curl non-zero must NOT kill
 # Post/PR as the agent's OWN Gitea user when its token is configured; else the built-in bot.
 case "$NAME" in
   pm) TOK="$TOKEN_PM";; senior) TOK="$TOKEN_SENIOR";; junior) TOK="$TOKEN_JUNIOR";;
-  lead) TOK="$TOKEN_LEAD";; qa) TOK="$TOKEN_QA";; *) TOK="";;
+  lead) TOK="$TOKEN_LEAD";; qa) TOK="$TOKEN_QA";; ops) TOK="$TOKEN_OPS";; *) TOK="";;
 esac
 [ -z "$TOK" ] && TOK="$GT"
 git config user.name  "$NAME"

.gitea/workflows/scripts/route.sh

@@ -27,7 +27,7 @@ cp "$AGENTS_JSON" /tmp/agents.json
 # here — see agent.yml: this reusable workflow sees it as 'workflow_call'.)
 if [ -n "$CID" ]; then scan="$BODY"; else scan="$IBODY"; fi
 name=""
-for a in pm junior senior lead qa; do
+for a in pm junior senior lead qa ops; do
   case "$scan" in *"@$a"*) name=$a; break;; esac
 done
 if [ -z "$name" ]; then
@@ -44,7 +44,7 @@ echo "Routing to @$name (model=$model vision=$vision mode=$mode skills=$skills)"
 # Act as the agent's own Gitea user when its token is set; else the built-in bot.
 case "$name" in
   pm) TOK="$TOKEN_PM";; senior) TOK="$TOKEN_SENIOR";; junior) TOK="$TOKEN_JUNIOR";;
-  lead) TOK="$TOKEN_LEAD";; qa) TOK="$TOKEN_QA";; *) TOK="";;
+  lead) TOK="$TOKEN_LEAD";; qa) TOK="$TOKEN_QA";; ops) TOK="$TOKEN_OPS";; *) TOK="";;
 esac
 [ -z "$TOK" ] && TOK="$GT"
 git config user.name "$name"

.gitea/workflows/scripts/skill-gitea-admin.sh

@@ -59,20 +59,24 @@ curl -sS -X POST -H "Authorization: token $AGENT_TOKEN" -H "Content-Type: applic
 # 2) mint a scoped token AS that user (pick the narrowest scopes needed)
 tok=$(curl -sS -u "inter:$PW" -H "Content-Type: application/json" -X POST "$API/users/inter/tokens" \
       -d '{"name":"inter","scopes":["read:repository","write:issue"]}' | jq -r '.sha1')
-# 3) store it as a secret (org / repo / user level) — never print $tok
+# 3) store the value in BOTH places (see "Secret storage" below) — never print $tok
 curl -sS -X PUT -H "Authorization: token $AGENT_TOKEN" -H "Content-Type: application/json" \
   "$API/orgs/gitea/actions/secrets/TOKEN_INTER" -d "$(jq -nc --arg d "$tok" '{data:$d}')"
 ```
 Token **scopes** are groups of `read:`/`write:` on: `repository`, `issue`, `organization`, `user`,
 `package`, `notification`, `misc`, and (only for a privileged token) `admin`.
 
-## Token inventory — record everything in `gitea/secrets`
-The private repo **`gitea/secrets`** (readable only by @ffaerber and @ops) is the source of truth for
-tokens. Whenever you mint, rotate, or re-scope a token, append/update a row in its `tokens.md` via the
-contents API (`GET` the file for its `sha`, then `PUT` the updated base64 content with that `sha`):
-`| <token/secret name> | <owner user> | <scopes> | <Actions secret it is stored in> | <notes> |`.
-Storing the live value in the matching Actions secret is what workflows use; the `gitea/secrets` row
-is the human-readable inventory. Never paste a token value into any issue/PR/comment/log.
+## Secret storage — `gitea/secrets/.env` is the SOURCE OF TRUTH
+Every token/secret value MUST live in **`gitea/secrets/.env`** (private, readable only by @ffaerber and
+@ops) as a `KEY=value` line. That file is the master; the workflows only get a secret because `.env` is
+mirrored into the org Actions secrets. So whenever you mint, rotate, or re-scope a token you MUST do
+BOTH, in sync:
+  1. **`.env`**: `GET /repos/gitea/secrets/contents/.env` for its `sha`, add or replace the `KEY=value`
+     line, then `PUT` the updated base64 content with that `sha`.
+  2. **Actions secret**: `PUT /orgs/gitea/actions/secrets/{KEY}` with the same value (what runs use).
+When you DELETE a token, remove it from BOTH. Keep `gitea/secrets/README.md` (the table describing what
+each KEY is) up to date. Do NOT use `tokens.md` — the values live in `.env`. NEVER paste a token value
+into any issue/PR/comment/log; it only ever goes into `.env` and the Actions secret.
 
 ## Change a user's token scope (the "update my token" flow)
 Tokens are immutable — you can't edit scopes. Re-mint: delete the old token and create a new one,