docker: give each agent its own Gitea hands, and close the cross-approval hole

Phase 5 of docs/agents/GITEA-SETUP.md, plus a correction to Phase 2 that the
runbook could not have known it needed.

gitea-mcp v1.7.0 goes into both images, pinned by the sha256 the release
publishes and smoke-tested with `--version` at build time, so a bad pin fails
the build instead of the agent. Each entrypoint registers it at user scope for
that container's own identity, remove-then-add so a restart is idempotent.

The token is passed BY PATH. `-e GITEA_ACCESS_TOKEN=$(cat …)` would write it in
cleartext into ~/.claude.json, which every session in the container reads;
GITEA_ACCESS_TOKEN_FILE is new in the pinned version and leaves the secret in
its read-only mount. Verified against the binary's own --help, not assumed.

The tool filter stops being an experiment. The names are in the release README:
each agent gets issues, notifications, labels, milestones and pull requests, and
NOT `pull_request_review_write`. That one matters because separate identities
open a hole the runbook did not name: Gitea refuses to let an author approve
their own pull request, and does nothing about sylph-decoder approving
sylph-port's. Two agents could satisfy `required_approvals = 1` between
themselves and then merge, since branch protection blocks pushes to main and
never blocked merges.

Withholding the tool is defence in depth; the controls are in branch protection,
and both docs now say so: approvals whitelisted to the human so an agent's
approval does not count, merges whitelisted to the human so an approved PR is
still merged by a person. Phase 2's check gains the step that actually tests it
-- approve the throwaway PR yourself, then confirm the agent STILL has no merge
button. Without that step, the check passes on an instance where the agents can
merge each other's work.

Also settles two entries on the runbook's own "not verified" list: the tool
filter names, and the Gitea version (1.25.5, whose API schema carries
enable_merge_whitelist and enable_approvals_whitelist under those names).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01McNbzUeq1KRBWs4G6X2YVj

docker/decoder/sylph-decoder

@@ -23,6 +23,8 @@
 #   SYLPH_REMOTE_NAME  Remote Control session name (default: sylpheed-agent)
 #   SYLPH_GIT_CREDENTIALS  file with `https://<user>:<token>@host` for push-work
 #                      (default: $HOME/.sylph-git-credentials)
+#   SYLPH_GITEA_TOKEN  this agent's own Gitea token file
+#                      (default: $HOME/.sylph-gitea-token-decoder)
 #   SYLPH_LOOP_INTERVAL   fixed loop cadence, e.g. 30m (default: 45m)
 #   SYLPH_CPUS / SYLPH_MEM_GB   override the computed half
 set -euo pipefail
@@ -229,6 +231,29 @@ docker_args() {
     echo "    or point SYLPH_GIT_CREDENTIALS elsewhere." >&2
   fi
 
+  # ── Gitea ──
+  # This agent's OWN token, for its OWN Gitea account — not the push credential
+  # and not the human's. Three reasons it is separate: `~/.sylph-git-credentials`
+  # is scoped `write:repository` and every issue endpoint REFUSES it; a pull
+  # request the agent authored is one a human can approve, which is the entire
+  # review gate; and revoking one agent then touches neither the other nor you.
+  #
+  # Mounted read-only and passed to the MCP server BY PATH — see the entrypoint
+  # for why the value must not go through the environment.
+  # Inert until the file exists: the container still runs, with no issues.
+  GITEATOK="${SYLPH_GITEA_TOKEN:-$HOME/.sylph-gitea-token-decoder}"
+  if [ -f "$GITEATOK" ]; then
+    _out+=(
+      -v "$GITEATOK:/sylph-home/re/.sylph-gitea-token:ro"
+      -e "GITEA_TOKEN_FILE=/sylph-home/re/.sylph-gitea-token"
+    )
+  else
+    echo "==> NOTE: no Gitea token at $GITEATOK — this agent cannot read its" >&2
+    echo "    notifications, open an issue or open a pull request. Generate one" >&2
+    echo "    while logged in AS sylph-decoder: Settings -> Applications, scopes" >&2
+    echo "    write:repository, write:issue, write:notification, read:user." >&2
+  fi
+
   [ -n "${ANTHROPIC_API_KEY:-}" ] && _out+=(-e "ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY")
   [ -n "${SYLPH_VULKAN:-}" ]      && _out+=(-e "SYLPH_VULKAN=$SYLPH_VULKAN")
   [ -n "${SYLPH_REMOTE:-}" ]      && _out+=(-e "SYLPH_REMOTE=$SYLPH_REMOTE")