docs: the tag push takes its token from the secret store; a repository address holds no credential (R-925)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,9 @@
+## Unreleased (2026-11-11) — docs only: a repository address holds no credential (R-925, Part C of the clock/end-dates run)
+
+- `scripts/release-agent.sh` header: the tag push needs `GITEA_GIT_TOKEN` from the secret store (`sec run`). The origin
+  address of CC's clone on DooPlex held a login and a token until 2026-11-11; git now asks the helper
+  `felhom.eu/scripts/git-credential-sec.sh`. No code change, no version change, no release.
+
 ## v0.173.0 (2026-11-10) — R-1368 part 2: the self-update folder keeps what it needs and no more — RELEASED and VOUCHED 2026-11-10 (release-agent.sh from a clean clone of `776025c`; agent sha256 752b2727fb6043417ae5f342acbda52330521b21bb799fda90760b960feef7ea, bundle sha256 51ebc1f4c66d87918c87c035b4297c0e40e10ed31e3250c3837dfeaa0002e1c1)
 
 - **The defect (measured 2026-11-10, space list place H12).** `Execute` downloads each new agent to

scripts/release-agent.sh

@@ -33,6 +33,9 @@
 # Env: GITEA_USER/GITEA_TOKEN (package write) — same credentials publish-agent.sh already takes.
 #      GITEA_BASE / GITEA_OWNER override the defaults.
 #      RELEASE_ALLOW_DIRTY=1 skips the clean-tree gate (for a rehearsal; never for a real release).
+#      GITEA_GIT_TOKEN — the tag push (`git push origin <tag>`) needs it since 2026-11-11: the address of a CC clone
+#      on DooPlex holds no credential, and git takes the token from the secret store through the helper
+#      felhom.eu/scripts/git-credential-sec.sh. Run the release as `sec run GITEA_GIT_TOKEN,... -- scripts/release-agent.sh <version>`.
 set -euo pipefail
 
 GITEA_BASE="${GITEA_BASE:-https://gitea.dooplex.hu}"