feat(manifest): trusted agent forge identity and guidance

Implements PRD prd-new-trusted-agent-forge-identity. Moves author identity
and named forge configurations onto the trusted, host-only agent definition,
and lets a bottle repository optionally associate a git-gate repo with one of
the agent's forge aliases.

- Agent-owned identity: new `author` (name/email) and `forge-accounts`
  (alias -> canonical Gitea /api/v1 origin + host `token_secret` ref) on the
  agent manifest. `author` populates the bottle's git user.name/user.email.
- Remove `git-gate.user` from both agents and bottles; fail with a migration
  pointer to `author`. `git-gate` is no longer accepted on an agent.
- Bottle git-gate repos gain optional `forge: <alias>`, resolved against the
  selected agent's forge-accounts at composition (fail-closed on unknown).
- Fail-closed Gitea API URL validation (https, no userinfo/query/fragment,
  /api/v1 base, host lowercased, trailing slash normalized, host dedup).
- Proxy-held credential: synthesize one inspected, token-authenticated egress
  route per referenced forge alias, scoped to the origin + API prefix. The
  token is resolved from the host env at launch into the egress proxy only —
  never the bottle env, prompt, gitconfig, or workspace.
- Generated, non-secret forge workflow guidance appended to the agent prompt
  for associated repos (API base, branch-backed PR flow, AGit-ref prohibition,
  mutation verification); omitted when no repo declares a forge.
- Agents become home-only: cwd `.bot-bottle/agents` no longer contributes,
  overrides, or is selectable; warned-and-ignored like cwd bottles.
- Docs: README examples, PRD 0011 supersession note, manifest schema docstring.
- Tests: new test_forge_identity suite; legacy git-gate.user/cwd tests updated
  to the agent-owned identity model.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -182,7 +182,9 @@ BOT_BOTTLE_BACKEND=firecracker ./cli.py start <agent>
 
 ## Manifest
 
-Bottles and agents are Markdown files with YAML frontmatter under `~/.bot-bottle/`. The Markdown body is the system prompt. Bottles live in `~/.bot-bottle/bottles/`; agents may also be shipped by a repo at `<repo>/.bot-bottle/agents/<name>.md`.
+Bottles and agents are Markdown files with YAML frontmatter under `~/.bot-bottle/`. The Markdown body is the system prompt. Both bottles and agents are **home-only**: they live under `~/.bot-bottle/bottles/` and `~/.bot-bottle/agents/`. A `<repo>/.bot-bottle/agents/<name>.md` shipped by a workspace is ignored with a warning — since an agent may select a host identity and forge secret, checked-out content must not define one (PRD prd-new-trusted-agent-forge-identity). Keep repo-specific behavioral instructions in `AGENTS.md` instead.
+
+Identity is **agent-owned**: the author name/email and named forge accounts live on the agent, not under `git-gate` (which now carries only Git transport policy). A bottle repo may optionally name one of the selected agent's forge aliases via `forge:`.
 
 **Bottle** (`~/.bot-bottle/bottles/gitea-dev.md`):
 
@@ -190,37 +192,19 @@ Bottles and agents are Markdown files with YAML frontmatter under `~/.bot-bottle
 ---
 extends: claude          # inherit the Claude provider boundary
 
-env:
-  GIT_AUTHOR_NAME: didericis
-
-git:
-  user:
-    name: "Eric Bauerfeld"
-    email: "eric+claude@dideric.is"
-  remotes:
-    gitea.dideric.is:
-      Name: bot-bottle
-      Upstream: ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git
-      IdentityFile: /Users/didericis/.ssh/id_ed25519_gitea
-      KnownHostKey: ssh-ed25519 AAAA...
-
-egress:
-  routes:
-    - host: gitea.dideric.is
-      inspect:
-        auth:
-          scheme: token        # Bearer | token
-          token_ref: BOT_BOTTLE_GITEA_TOKEN
-        matches:               # optional — restrict to specific paths/methods/headers
-          - paths:
-              - {type: prefix, value: /api/v1/}
-            methods: [GET, POST, PATCH, DELETE]
-        outbound_detectors: [token_patterns, known_secrets]
-        inbound_detectors: false   # disable response scanning for this host
+git-gate:
+  repos:
+    bot-bottle:
+      url: ssh://git@gitea.dideric.is:30009/didericis/bot-bottle.git
+      key:
+        provider: gitea
+        forge_token_env: GITEA_DEPLOY_TOKEN   # deploy-key admin (push), PRD 0048
+      host_key: "ssh-ed25519 AAAA..."
+      forge: didericis-gitea                  # ← selects the agent's forge alias
 ---
 
-The `gitea-dev` bottle. Provider auth via the inherited Claude route;
-gitea over SSH for push, token over HTTPS for the API.
+The `gitea-dev` bottle. Gitea over SSH for push; the API credential and
+workflow guidance come from the agent's `forge: didericis-gitea` association.
 ````
 
 **Agent** (`~/.bot-bottle/agents/gitea-helper.md`):
@@ -230,11 +214,27 @@ gitea over SSH for push, token over HTTPS for the API.
 bottle: gitea-dev
 skills:
   - init-prd
+author:
+  name: didericis-claude
+  email: eric+claude@dideric.is
+forge-accounts:
+  didericis-gitea:
+    url: https://gitea.dideric.is/api/v1
+    auth:
+      type: token
+      token_secret: GITEA_CLAUDE_TOKEN       # host env var; value never enters the bottle
 ---
 
 You help maintain Gitea-hosted projects.
 ````
 
+`author` populates the bottle's `git config user.name/user.email`. When a
+selected repo names a `forge` alias, bot-bottle resolves the alias's
+`token_secret` from the host env into the egress proxy only (never the bottle),
+adds a scoped, proxy-authenticated route to the Gitea API origin, and appends
+non-secret forge workflow guidance to the agent's system prompt. Neither the
+token value nor its `token_secret` name appears in the bottle env or prompt.
+
 **Egress route fields:**
 
 | Field | Required | Description |