Gate the token mint's main-rule write by keep-main-rules too

The operator, 2026-10-23: "disable the gitea branch protection reset thing". setUpToolsAccount (run at every token mint) called ensureMainMerges regardless; it now does so only when the setting is true.

modules/gitea/test/mainrules.test.ts

@@ -41,3 +41,24 @@ test("true: every step puts the rules right", async () => {
   assert.equal(writes, 2);
   assert.deepEqual(said, ["[gitea] main's rule is right in 2 repositories"]);
 });
+
+test("a token mint's account setup writes no protection while keep-main-rules is false, and does when true", async () => {
+  const { setUpToolsAccount } = await import("../dist/tools-account.js");
+  for (const [keep, want] of [[false, 0], [true, 1]] as const) {
+    let merges = 0;
+    const forge = {
+      ensureUser: async () => {}, ensureTeamWith: async () => 1, addUserToTeam: async () => {},
+      ensureMainMerges: async () => { merges++; return []; },
+    };
+    await setUpToolsAccount(forge, "mesh-tools", () => "pw", keep);
+    assert.equal(merges, want);
+  }
+  // The default comes from the setting, which is false when the config does not say true.
+  let merges = 0;
+  const saved = process.env.MESH_GITEA_CONFIG_FILE;
+  delete process.env.MESH_GITEA_CONFIG_FILE;
+  try {
+    await setUpToolsAccount({ ensureUser: async () => {}, ensureTeamWith: async () => 1, addUserToTeam: async () => {}, ensureMainMerges: async () => { merges++; return []; } }, "mesh-tools", () => "pw");
+  } finally { if (saved !== undefined) process.env.MESH_GITEA_CONFIG_FILE = saved; }
+  assert.equal(merges, 0);
+});