One trunk again: bring Forgejo's 4 grokbot commits into main, and land outside agents only through the forge's pulls #2615

This merges grokbot's two Forgejo pulls into main and adds a push rule. With that rule, a protected default branch takes a direct git push only from its admins; every other writer has to open a pull. Two parts of the issue are not done and need the owner, listed at the end.

Merge (commit 1). This merges upstream-main (6c30ec09/5881c081 and a97b8e6b/68084231) into main. Both changes were already on main by content from grokbot's direct pushes. So the two conflicts, in src/crew/parks.ts and src/actions/issues.ts, were only main's later additions: the alreadyDone import and the limb re-plan's replanSince. I kept both as main has them. The merge commit changes no files; it only makes Forgejo's main an ancestor of main, so the mirror can fast-forward again.

Push rule (commit 2). Before this, the pre-receive hook in src/http/server.ts refused only agent accounts, force pushes and deletions. grokbot's account is a user, not an agent, which is how it pushed straight to main. With protection on, the hook now refuses a push to the default branch from anyone who isn't an admin, with the line main is protected: only its admins push it; open a pull from a branch. That is the same rule the web editor already applies in src/actions/contents.ts.

• Merges are unaffected: they move the ref directly (src/git/merge.ts) and never run the hook.
• An unprotected default branch behaves as before.
• The settings page text and docs/THREATS.md now describe the rule.

Test. test/protected-default-push.test.ts sets up an org repo with an owner and a writer who isn't an admin. It checks four things:

• With protection off, the writer's push to main still lands.
• With protection on, the writer's push is refused with that line and main doesn't move.
• The writer's branch lands through a pull that an admin merges.
• The admin can still push to main directly.

Without the hook change, the refusal and pull cases fail. The new test and the existing protection, branch, editor, settings and hollow tests all pass, and the type check is clean.

Not done:

• Protection is off on trevato/forge (protectDefault: false), so the rule does nothing there until the owner ticks "Protect the default branch" in settings. I'm not allowed to change repository settings.
• grokbot must not be an admin of the repo or its owner's teams, because admins can still push. I couldn't check its role from here.
• Part (3), locking Forgejo main to the steward's mirror push, is Forgejo's own branch-protection setting. Nothing in this repository controls it, so I didn't do it.

To try it: bun test test/protected-default-push.test.ts

🤖 Generated with Claude Code

Closes #2614

This merges grokbot's two Forgejo pulls into main and adds a push rule. With that rule, a protected default branch takes a direct git push only from its admins; every other writer has to open a pull. Two parts of the issue are not done and need the owner, listed at the end.

Merge (commit 1). This merges upstream-main (6c30ec09/5881c081 and a97b8e6b/68084231) into main. Both changes were already on main by content from grokbot's direct pushes. So the two conflicts, in src/crew/parks.ts and src/actions/issues.ts, were only main's later additions: the alreadyDone import and the limb re-plan's replanSince. I kept both as main has them. The merge commit changes no files; it only makes Forgejo's main an ancestor of main, so the mirror can fast-forward again.

Push rule (commit 2). Before this, the pre-receive hook in src/http/server.ts refused only agent accounts, force pushes and deletions. grokbot's account is a user, not an agent, which is how it pushed straight to main. With protection on, the hook now refuses a push to the default branch from anyone who isn't an admin, with the line main is protected: only its admins push it; open a pull from a branch. That is the same rule the web editor already applies in src/actions/contents.ts.

• Merges are unaffected: they move the ref directly (src/git/merge.ts) and never run the hook.
• An unprotected default branch behaves as before.
• The settings page text and docs/THREATS.md now describe the rule.

Test. test/protected-default-push.test.ts sets up an org repo with an owner and a writer who isn't an admin. It checks four things:

• With protection off, the writer's push to main still lands.
• With protection on, the writer's push is refused with that line and main doesn't move.
• The writer's branch lands through a pull that an admin merges.
• The admin can still push to main directly.

Without the hook change, the refusal and pull cases fail. The new test and the existing protection, branch, editor, settings and hollow tests all pass, and the type check is clean.

Not done:

• Protection is off on trevato/forge (protectDefault: false), so the rule does nothing there until the owner ticks "Protect the default branch" in settings. I'm not allowed to change repository settings.
• grokbot must not be an admin of the repo or its owner's teams, because admins can still push. I couldn't check its role from here.
• Part (3), locking Forgejo main to the steward's mirror push, is Forgejo's own branch-protection setting. Nothing in this repository controls it, so I didn't do it.

To try it: bun test test/protected-default-push.test.ts

🤖 Generated with Claude Code