Every token value must be written to gitea/secrets/.env (the master, mirrored to org Actions secrets) AND the Actions secret, kept in sync, removed from both on delete. Drop the tokens.md instruction — the @ops test dutifully re-created tokens.md because the skill still referenced it.