Let gitea_commit take a large patch from a hash-checked spool file (issue 852)

A feature's diff is megabytes, too large to type into a call. gitea_commit now also takes patch_file, the
random hex name of a file in the module's spool directory /var/lib/mesh/forge-patches (mode 0733, owned by
the machine's account), with patch_sha256. The tool reads only that directory, never through a symlink or a
hard link, refuses a file whose SHA-256 differs, applies it as it applies patch, and removes it.

Co-Authored-By: Claude <noreply@anthropic.com>

modules/gitea/module.json

@@ -184,6 +184,13 @@
       "trusted": true,
       "content": "# The accounts whose \"ready at <sha>\" comment marks a pull request ready (novox/hq issue 722), from the setting\n# ready-authors, written by the mesh. Replaced on every push; change the setting, never this file.\nauthors=${setting:ready-authors}\n"
     },
+    {
+      "id": "forge-patches",
+      "type": "directory",
+      "path": "/var/lib/mesh/forge-patches",
+      "mode": "0733",
+      "owner": "${machine:account}"
+    },
     {
       "id": "state",
       "type": "directory",
@@ -347,7 +354,8 @@
         "env": {
           "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
           "MESH_GITEA_TOOLS_USER": "mesh-tools",
-          "MESH_GITEA_TOKEN_FILE": "${dir:runtime-state}/token"
+          "MESH_GITEA_TOKEN_FILE": "${dir:runtime-state}/token",
+          "MESH_GITEA_PATCH_DIR": "${dir:forge-patches}"
         }
       }
     ]