chore(local): reuse FORGEJO_TOKEN for the auto-patch push (#125)

Follow-up to #124 (merged): the auto-patch pipeline required a separate write-scoped `REPO_RW_TOKEN` to push the branch. Reuse the existing `FORGEJO_TOKEN` instead.

- `propose-patches.R --open-pr` now pushes `auto/registry-patch-proposals` over HTTPS with `FORGEJO_TOKEN` (the same token used for the PR API); the read-only `origin` clone URL can't push, so it builds an authenticated URL explicitly.
- Drop `REPO_RW_TOKEN` from `.crow/auto-apply-patches.yaml` and the docs.

No new secret needed: the pipeline's secrets are now `PGPASS`, `REPO_RO_TOKEN`, and `FORGEJO_TOKEN` (all existing). `FORGEJO_TOKEN` must have repository write scope for the push to succeed.

105 tests pass; all pre-commit hooks pass.

Reviewed-on: #125

local/propose-patches.R

@@ -21,8 +21,8 @@
 #                        the proposals ledger (commit + open a PR yourself)
 #       --open-issue     post/update a Forgejo tracking issue (needs FORGEJO_TOKEN)
 #       --open-pr        write the entries, push the `auto/registry-patch-proposals`
-#                        branch, and open/update a PR autonomously (needs
-#                        FORGEJO_TOKEN, and REPO_RW_TOKEN to push in CI). The
+#                        branch, and open/update a PR autonomously. Uses
+#                        FORGEJO_TOKEN for both the push and the PR API. The
 #                        `trial-build-registry` pipeline is the merge gate.
 #       --limit N        only act on the top-N candidates by failure volume
 #                        (bounded batch; the rest are picked up on the next run)
@@ -466,18 +466,15 @@ if (do_write) {
       if (length(candidate_entries) == 1L) "entry" else "entries"
     )
   )
-  # Push with a write token when provided (CI); otherwise rely on origin creds.
-  rw_token <- Sys.getenv("REPO_RW_TOKEN")
-  push_target <- if (nchar(rw_token) > 0L) {
-    sprintf(
-      "https://%s:%s@git.devxy.io/%s.git",
-      Sys.getenv("GIT_USER", "devxy-bot"),
-      rw_token,
-      repo
-    )
-  } else {
-    "origin"
-  }
+  # Push over HTTPS with FORGEJO_TOKEN (same token used for the PR API), so no
+  # separate write-scoped secret is needed. The read-only `origin` clone URL
+  # can't push, so build an authenticated URL explicitly.
+  push_target <- sprintf(
+    "https://%s:%s@git.devxy.io/%s.git",
+    Sys.getenv("GIT_REMOTE_USER", "pat-s"),
+    forgejo_token,
+    repo
+  )
   git("push", "-f", push_target, sprintf("HEAD:refs/heads/%s", pr_branch))
 
   pr_title <- sprintf(