feat(manifest): trusted agent forge identity and guidance

Implements PRD prd-new-trusted-agent-forge-identity. Moves author identity
and named forge configurations onto the trusted, host-only agent definition,
and lets a bottle repository optionally associate a git-gate repo with one of
the agent's forge aliases.

- Agent-owned identity: new `author` (name/email) and `forge-accounts`
  (alias -> canonical Gitea /api/v1 origin + host `token_secret` ref) on the
  agent manifest. `author` populates the bottle's git user.name/user.email.
- Remove `git-gate.user` from both agents and bottles; fail with a migration
  pointer to `author`. `git-gate` is no longer accepted on an agent.
- Bottle git-gate repos gain optional `forge: <alias>`, resolved against the
  selected agent's forge-accounts at composition (fail-closed on unknown).
- Fail-closed Gitea API URL validation (https, no userinfo/query/fragment,
  /api/v1 base, host lowercased, trailing slash normalized, host dedup).
- Proxy-held credential: synthesize one inspected, token-authenticated egress
  route per referenced forge alias, scoped to the origin + API prefix. The
  token is resolved from the host env at launch into the egress proxy only —
  never the bottle env, prompt, gitconfig, or workspace.
- Generated, non-secret forge workflow guidance appended to the agent prompt
  for associated repos (API base, branch-backed PR flow, AGit-ref prohibition,
  mutation verification); omitted when no repo declares a forge.
- Agents become home-only: cwd `.bot-bottle/agents` no longer contributes,
  overrides, or is selectable; warned-and-ignored like cwd bottles.
- Docs: README examples, PRD 0011 supersession note, manifest schema docstring.
- Tests: new test_forge_identity suite; legacy git-gate.user/cwd tests updated
  to the agent-owned identity model.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/manifest/agent.py

@@ -3,11 +3,11 @@
 from __future__ import annotations
 
 from dataclasses import dataclass, field
-from typing import cast
+from typing import Mapping, cast
 
 from ..agent_provider import PROVIDER_TEMPLATES
 from .util import ManifestError, as_json_object
-from .git import ManifestGitUser
+from .forge import ManifestAuthor, ManifestForgeAccount
 from .schema import AGENT_MODEL_KEYS, is_valid_entity_name
 
 
@@ -119,15 +119,29 @@ class ManifestAgent:
     bottle: str = ""
     skills: tuple[str, ...] = ()
     prompt: str = ""
-    # Per-agent git identity (issue #94). Overlays the referenced
-    # bottle's git-gate.user per-field at `Manifest.bottle_for`. Only
-    # `user` is allowed at the agent level; `repos` stays bottle-only
-    # because it carries credentials and host trust.
-    git_user: ManifestGitUser = ManifestGitUser()
+    # Agent-owned identity (PRD prd-new-trusted-agent-forge-identity).
+    # `author` populates the bottle's git user.name/user.email;
+    # `forge_accounts` maps a forge alias to a canonical Gitea API origin and
+    # a host token reference. Both live only on the agent — never under
+    # `git-gate`, which is bottle-only transport policy.
+    author: ManifestAuthor | None = None
+    forge_accounts: Mapping[str, ManifestForgeAccount] = field(
+        default_factory=dict
+    )
 
     @classmethod
     def from_dict(cls, name: str, raw: object, bottle_names: set[str]) -> "ManifestAgent":
         d = as_json_object(raw, f"agent '{name}'")
+        # git-gate is no longer accepted on an agent (checked before the
+        # generic unknown-key error so the migration pointer is surfaced):
+        # identity moved to `author`, and git-gate.repos is bottle-only.
+        if "git-gate" in d:
+            raise ManifestError(
+                f"agent '{name}' has a 'git-gate' block, which is no longer "
+                f"accepted on an agent (PRD prd-new-trusted-agent-forge-identity). "
+                f"Move git-gate.user name/email into the 'author' block; "
+                f"git-gate.repos stays on the bottle."
+            )
         unknown = set(d.keys()) - AGENT_MODEL_KEYS
         if unknown:
             allowed = ", ".join(sorted(AGENT_MODEL_KEYS))
@@ -191,24 +205,30 @@ class ManifestAgent:
                 f"(was {type(prompt_raw).__name__})"
             )
 
-        # git-gate: agents may declare only `git-gate.user` (name/email).
-        # `git-gate.repos` is bottle-only — it carries credentials and host trust.
-        git_user = ManifestGitUser()
-        git_raw = d.get("git-gate")
-        if git_raw is not None:
-            gd = as_json_object(git_raw, f"agent '{name}' git-gate")
-            for k in gd:
-                if k != "user":
-                    raise ManifestError(
-                        f"agent '{name}' git-gate.{k} is not allowed at the "
-                        f"agent level; only git-gate.user (name/email) may be "
-                        f"set on an agent. git-gate.repos is bottle-only "
-                        f"(it carries credentials and host trust)."
-                    )
-            if "user" in gd:
-                git_user = ManifestGitUser.from_dict(name, gd["user"])
+        # author: agent-owned git identity (optional; both fields required
+        # when present). Populates the bottle's user.name/user.email.
+        author = (
+            ManifestAuthor.from_dict(name, d["author"])
+            if "author" in d else None
+        )
 
-        return cls(bottle=bottle, skills=skills, prompt=prompt, git_user=git_user)
+        # forge-accounts: alias -> Gitea API origin + host token reference.
+        forge_accounts: dict[str, ManifestForgeAccount] = {}
+        forge_raw = d.get("forge-accounts")
+        if forge_raw is not None:
+            forge_d = as_json_object(forge_raw, f"agent '{name}' forge-accounts")
+            for alias, entry in forge_d.items():
+                forge_accounts[alias] = ManifestForgeAccount.from_dict(
+                    name, alias, entry,
+                )
+
+        return cls(
+            bottle=bottle,
+            skills=skills,
+            prompt=prompt,
+            author=author,
+            forge_accounts=forge_accounts,
+        )
 
 
 def _parse_provider_settings(