Let the forge's tools never weaken protection or merge past the checks

gitea_api took any endpoint with a token minted for the forge's
administrator with write:admin: an agent could drop a branch's protection
or its required checks, set the merge check's status, write to main or
merge its own pull request (novox/hq ADR 0266 §7, the review of
2026-10-09). gitea_api now reads anything but the administration and
writes only what an author writes; protection is only strengthened; a
merge needs every required status a success and merges only that head; a
guarded repository is not deleted; and the token is minted without
write:admin, a kept one re-minted at the next start.

modules/gitea/client.ts

@@ -463,10 +463,14 @@ export class GiteaClient {
     return res.text();
   }
 
-  async mergePullRequest(owner: string, repo: string, index: number, method = "merge", deleteBranch = false): Promise<void> {
+  /** Merge a pull request — never forced past its checks, and, given the head that was checked, only that head:
+   *  the forge refuses the merge when the branch moved since (novox/hq ADR 0266). */
+  async mergePullRequest(owner: string, repo: string, index: number, method = "merge", deleteBranch = false,
+    headCommit?: string): Promise<void> {
     await this.request(`/repos/${owner}/${repo}/pulls/${index}/merge`, {
       method: "POST",
-      body: JSON.stringify({ Do: method, delete_branch_after_merge: deleteBranch }),
+      body: JSON.stringify({ Do: method, delete_branch_after_merge: deleteBranch, force_merge: false,
+        ...(headCommit ? { head_commit_id: headCommit } : {}) }),
     });
   }