The mesh's forge accounts all read every repository, and a build's fetch says the forge's own words

mesh-catalog #495 gave read on every repository to the tools' account alone. The build modules
fetch over ssh as nox-builder (the forge-account provider's builders account, ADR 0466 §3), so
ace's and g14's fetch of jschoubben/car-hunter and jschoubben/snake still failed; the machines'
agents (nox-agent, ADR 0410 §1) could not read them either.

- gitea: readall.ts grants every account of one list, meshAccounts in tools-account.ts (mesh-tools,
  nox-builder, nox-agent; a Go test holds the two Go names to internal/forgeaccount's constants),
  on the same start pass, forge events and tools. gitea_unreadable_repos answers per account and
  names the accounts the forge does not hold yet; gitea_grant_read takes accounts as well as
  repositories. An absent account is asked nothing; the start pass runs again ten minutes apart
  until every account was there once.
- mesh-build-go, mesh-build-node, mesh-build-image: pin mesh-sdk 84275cfc (fix/fetch-reads-all),
  whose forgekey.Said keeps git's words past the bare "error:" line: the mirror's line said only
  "git -C: error:". Their own git reasons (ls-files, ls-remote, rev-parse, repack) go through it too.

modules/gitea/README.md

@@ -275,12 +275,17 @@ reported no key gets no entry, and its client says it waits. Keys titled `mesh:`
 a key added by hand never is. Every consumer is made again every ten minutes and at once when a key changes.
 `go test ./cmd/forge-account-provider ./internal/forgeaccount` runs it against a fake forge.
 
-## The tools' account reads every repository (the operator, 2026-10-26)
+## The mesh's accounts read every repository (the operator, 2026-10-26)
 
 The tools act as the plain account `mesh-tools` (ADR 0365 §2, issue 469), which writes to the organisation `novox`
-through its team. Any other repository it saw only when public, so a private repository of a user answered every tool
-404 and was missing from every list. `readall.ts` makes the account a collaborator that **reads only** on each
-repository it cannot read: one repository at a time, no organisation membership, the least the forge offers.
+through its team; the build modules fetch over ssh as `nox-builder` (ADR 0466 §3), in a team that reads the
+organisation's code; the machines' agents use `nox-agent` (ADR 0410 §1). Any other repository each saw only when public,
+so a private repository of a user answered every tool 404 and every build's fetch "not authorized to read". `readall.ts`
+makes each of these accounts (one list, `meshAccounts` in `tools-account.ts`, whose two Go names
+`internal/forgeaccount`'s test holds to its own constants) a collaborator that **reads only** on each repository it
+cannot read: one repository at a time, no organisation membership, the least the forge offers. An account the forge
+does not hold yet (the forge-account provider makes `nox-builder` and `nox-agent` when their first consumer asks) is
+named and asked nothing; the start's pass is run again ten minutes apart until every account was there once.
 
 - **When:** one pass over every repository of every user and organisation at the start (a forge not answering yet is
   asked again a minute apart until one pass ran), and on the forge's system webhook: `forge.repository.created` and
@@ -292,11 +297,12 @@ repository it cannot read: one repository at a time, no organisation membership,
   the forge will not answer is named as refused (or, in the listing, with permission `unknown`) and the pass goes on.
 - **With what:** the site administrator's login (`MESH_GITEA_ADMIN_PASSWORD_FILE`), because adding a collaborator asks a
   repository's administration, which on another user's repository only the site administrator holds. It is used for
-  four calls alone: list every repository, read one, read the account's permission on one, add the account as a read
-  collaborator. The tools' own calls keep their token.
-- **Tools:** `gitea_unreadable_repos` (every repository the account cannot read, the permission the forge gives it
-  there and why) and `gitea_grant_read` (the same grant by hand, now, on every repository or on those named; each grant
-  read back from the forge, a refusal answered in the forge's own words).
+  five calls alone: list every repository, read one, whether an account exists, read an account's permission on one,
+  add an account as a read collaborator. The tools' own calls keep their token.
+- **Tools:** `gitea_unreadable_repos` (per account, every repository it cannot read, the permission the forge gives
+  it there and why, a count per account and the accounts the forge does not hold) and `gitea_grant_read` (the same
+  grant by hand, now, on every repository or on those named, for every account or those named; each grant read back
+  from the forge, a refusal answered in the forge's own words).
 
 ## Files it does not know