Give claude-code's runtime its forge credential file, and say a credential it cannot place as a condition (issue 774)

The file gitea-read.secret was declared with no owner, so it was root's at 0600; claude-code's tools run in the
node's runtime as the operator's account and could not read it ("permission denied", ~870 times a machine), said
only in the journal. A file a bundle reads is the runtime account's only when a word of the bundle names it
(catalogue givenTo); this one was found through MESH_CLAUDE_CODE_STATE alone.

Quick fix: name the file with the bundle word MESH_CLAUDE_CODE_FORGE, which the reader now uses. Thorough fix: the
same, plus a failure to place the credential raises a warning condition of the module on the operator-channel seat,
once per reason, cleared when it places again. Chose thorough: the fault ran unseen for days. A change of the
credential now restarts the node's runtime, as for every file a bundle word names.
claude-code's mesh-sdk pin moves to 2da0de75 (main's), the first with asks.Condition.

modules/claude-code/cmd/claude-code/forge.go

@@ -24,6 +24,8 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/asks"
 )
 
 // ForgeProvision is the provision whose credential this is, and the file this module's manifest has it delivered to.
@@ -32,7 +34,59 @@ const (
 	forgeSecret    = "gitea-read.secret"
 )
 
-func (p Paths) forgeSecret() string { return filepath.Join(p.State, forgeSecret) }
+func (p Paths) forgeSecret() string {
+	if p.Forge != "" {
+		return p.Forge
+	}
+	return filepath.Join(p.State, forgeSecret)
+}
+
+// ForgeHealth is what this module says to the operator of its forge credential (the sweep of 2026-10-30, issue 774:
+// the file was root's, 0600, and the runtime, the operator's account, could not read it; said only in the journal,
+// some 870 times a machine). raised is the reason last raised, "" when none.
+type ForgeHealth struct {
+	Node   string
+	raised string
+	looked bool
+}
+
+// forgeConditionKey is the condition's key: its last part is its kind.
+func (f *ForgeHealth) key() string { return "claude-code.machine." + f.Node + ".forge-credential" }
+
+// Look is the condition to say after one placing of the credential, nil when nothing changed: raised on a failure, again
+// when its reason changes, cleared when it places again; on the first look a success clears what a run before raised.
+func (f *ForgeHealth) Look(err error) *asks.Condition {
+	first := !f.looked
+	f.looked = true
+	subject := asks.Scope{Scope: "machine", ID: f.Node, Machine: f.Node}
+	if err == nil {
+		if f.raised == "" && !first {
+			return nil
+		}
+		f.raised = ""
+		return &asks.Condition{Key: f.key(), Subject: subject, State: asks.StateCleared}
+	}
+	why := err.Error()
+	if why == f.raised {
+		return nil
+	}
+	f.raised = why
+	needs := "read claude-code's journal on " + f.Node + " and the owner of its forge credential file"
+	return &asks.Condition{Key: f.key(), Severity: asks.SeverityWarning, State: asks.StateRaised, Subject: subject,
+		Headline: "Agents on " + f.Node + " cannot use the forge credential",
+		Summary:  why, Needs: needs,
+		Explanation: asks.NeedsYou + needs + ". " + sentence(why) + " Until it is placed, an agent there cannot " +
+			"clone or fetch the mesh's private repositories.",
+		Resolved: "The forge's read credential is placed again on " + f.Node + "."}
+}
+
+func sentence(s string) string {
+	s = strings.TrimSpace(s)
+	if s == "" || strings.HasSuffix(s, ".") {
+		return s
+	}
+	return strings.ToUpper(s[:1]) + s[1:] + "."
+}
 
 // forgeCredentials is where the agent's git reads the credential: under the agent's home, in a directory of the
 // mesh's own.