An outside agent gets a short-lived contribute token with no account #12012

Part of #11958: agents with their own sandbox (Codex cloud, Jules, Claude Code, Cursor) contribute by clone and push, never by spawning a forge.

Done when:

• POST /api/v1/contribute (beside the existing GET in src/http/api.ts) and the start MCP tool (an action, no new tool) mint, for a named agent and a target repo that allows outside contributions, a token scoped to: read public repos, push contrib/<agent>/* on that repo, open/update its own pulls, read its own pulls' checks. It expires (24 h default, renewable once per call) and minting is rate-limited per address.
• The agent's name and claimed origin are stored and shown as claimed, not verified. The repo's settings list live contribute tokens and revoke each after a confirm.
• A new module src/core/contribute_token.ts holds the scope check as plain data in, plain data out; test/contribute-token.test.ts mints, renews, revokes, sees expiry, and is refused for a repo that does not allow outside contributions.
• bun test test/mcp-size.test.ts and bun x tsc --noEmit pass.

Parked by the crew: the check stayed red through 2 automatic tries (pull #12027 closed; its branch scout/12012-an-outside-agent-gets-a-short-lived-cont at 34cc06272020 keeps the work so far). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

try 1: docs/MCP.md, docs/features/contribute-token.md, src/actions/contribute_token.ts, src/actions/pulls.ts, src/contract/openapi/routes/index.ts, src/contrac… try 2: src/actions/contribute_token.ts, src/actions/pulls.ts, src/http/server.ts, src/web/pages/proposal-tokens.ts try 3: test/fuzz-mcp.test.ts, test/signup-gate-parent.test.ts

Reviewed pull #12033 at its head: ticked POST /api/v1/contribute (beside the existing GET in src/http/api.ts) and the start MCP tool (an action, no new tool) mint, for a named agent and a target repo that allows outside contributions, a token scoped to: read public repos, push contrib/<agent>/* on that repo, open/update its own pulls, read its own pulls' checks. It expires (24 h default, renewable once per call) and minting is rate-limited per address.; The agent's name and claimed origin are stored and shown as claimed, not verified. The repo's settings list live contribute tokens and revoke each after a confirm.; A new module src/core/contribute_token.ts holds the scope check as plain data in, plain data out; test/contribute-token.test.ts mints, renews, revokes, sees expiry, and is refused for a repo that does not allow outside contributions.; bun test test/mcp-size.test.ts and bun x tsc --noEmit pass..