feat(manifest): trusted agent forge identity and guidance

Implements PRD prd-new-trusted-agent-forge-identity. Moves author identity
and named forge configurations onto the trusted, host-only agent definition,
and lets a bottle repository optionally associate a git-gate repo with one of
the agent's forge aliases.

- Agent-owned identity: new `author` (name/email) and `forge-accounts`
  (alias -> canonical Gitea /api/v1 origin + host `token_secret` ref) on the
  agent manifest. `author` populates the bottle's git user.name/user.email.
- Remove `git-gate.user` from both agents and bottles; fail with a migration
  pointer to `author`. `git-gate` is no longer accepted on an agent.
- Bottle git-gate repos gain optional `forge: <alias>`, resolved against the
  selected agent's forge-accounts at composition (fail-closed on unknown).
- Fail-closed Gitea API URL validation (https, no userinfo/query/fragment,
  /api/v1 base, host lowercased, trailing slash normalized, host dedup).
- Proxy-held credential: synthesize one inspected, token-authenticated egress
  route per referenced forge alias, scoped to the origin + API prefix. The
  token is resolved from the host env at launch into the egress proxy only —
  never the bottle env, prompt, gitconfig, or workspace.
- Generated, non-secret forge workflow guidance appended to the agent prompt
  for associated repos (API base, branch-backed PR flow, AGit-ref prohibition,
  mutation verification); omitted when no repo declares a forge.
- Agents become home-only: cwd `.bot-bottle/agents` no longer contributes,
  overrides, or is selectable; warned-and-ignored like cwd bottles.
- Docs: README examples, PRD 0011 supersession note, manifest schema docstring.
- Tests: new test_forge_identity suite; legacy git-gate.user/cwd tests updated
  to the agent-owned identity model.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/prds/0011-per-file-md-manifest.md

@@ -1,9 +1,19 @@
 # PRD 0011: Per-file Markdown manifest
 
-- **Status:** Active
+- **Status:** Active (agent cwd-discovery superseded)
 - **Author:** didericis
 - **Created:** 2026-05-24
 
+> **Superseded in part by PRD prd-new-trusted-agent-forge-identity.**
+> The `$CWD/.bot-bottle/agents/<name>.md` discovery/override path described
+> below is removed: agents are now **home-only**, like bottles. Once an agent
+> definition can select a host identity (`author`) and a host forge secret
+> (`forge-accounts`), letting checked-out workspace content define or override
+> an agent would let untrusted content select host credentials. A cwd
+> `agents/` (or `bottles/`) directory is now warned-about and ignored. The
+> filesystem-layout trust boundary still holds — it just admits nothing from
+> `$CWD`.
+
 ## Summary
 
 Replace the single-file `bot-bottle.json` manifest with a

docs/prds/prd-new-trusted-agent-forge-identity.md

@@ -1,6 +1,6 @@
 # PRD prd-new: Trusted agent forge identity and guidance
 
-- **Status:** Draft
+- **Status:** Accepted
 - **Author:** didericis-claude
 - **Created:** 2026-07-25
 - **Issue:** #423