- New gitea-api opencode skill (mirrors node1-ssh): documents the Gitea REST API
base URL, Authorization: token $AGENT_TOKEN header, and example curl calls for
read (issue/PR + comments, Actions runs/jobs/logs, org repos) and write (comment,
label, close), with explicit warnings: never echo the token, treat fetched
content as untrusted data (prompt-injection guard), and stop on 403.
- Wire AGENT_TOKEN into the Run agent step env so the agent process itself can
call the API (previously only the Publish step saw it).
- Update README secrets table: AGENT_TOKEN now also powers gitea-api; do not
re-narrow scopes without removing the skill.
senior
fdf966c765