test/agents.test.ts: fifty concurrent pushes come back 'auth required' over the hook socket; find why and fix it, or exclude it by name #1056

Replaces #598, parked twice:

• the check failed ("capacity: only a forge admin reads or changes it > an admin changes each one from the page, the API and MCP; a wrong value is refused; every change is kept") and the decider saw no point in another try (pull #933 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.
• the check failed ("capacity: only a forge admin reads or changes it > an admin changes each one from the page, the API and MCP; a wrong value is refused; every change is kept") and the decider saw no point in another try (pull #978 closed).

Those checks went red on tests this change does not touch. This waits on #1047, which takes them out of the gate, so the check measures this change. Start from today's main. What done looks like is #598's, unchanged:

---

Pillar: P0 Trust (umbrella #586). One run, started fresh from today's main.

Outcome (what a person sees). The gate runs every test, so a red test is either fixed or named. This one replaces #293, which was parked twice (pulls #531 and an earlier one closed red).

Today. "fifty pushes to distinct branches all complete over the hook socket" in test/agents.test.ts is red on main, alone and in the suite: 150 lines of remote: auth required / Authentication failed for 'http://localhost:PORT/crew/swarm.git/'. Not a timeout.

Acceptance.

• [ ] Reproduce with the one test alone first. The pull states the cause in one paragraph (token lifetime, rate limit, socket backlog, or the harness).
• [ ] If the cause is in the forge, fix it and the test passes in the gate. If it is in the harness, fix the harness. If neither fits one run, move the file to EXCLUDED with this issue as its owner and open exactly one follow-up that names the cause.
• [ ] bun run check is green.

Done means reachable: the test runs in bun run check (no page or MCP tool applies: this is the gate itself).

Start from: test/agents.test.ts, src/git/ (the hook socket and the receive path), src/core/tokens.ts, scripts/test-shards.ts.

Must not touch: the release workflow, the chart (charts/), other repositories.