Add AgentGit M1: agent-native git layer over a Forgejo backend

AgentGit is a thin, DID-gated source-collaboration layer over a backend
forge (default Forgejo at git.profullstack.com, BBS-members-only) — not a
new git host. M1 implements the contract and engines:

- forge/adapter.ts: ForgeAdapter interface (only forge-specific surface)
- forge/forgejo.ts: ForgejoAdapter over Forgejo/Gitea REST v1 (injectable
  fetch, typed errors), incl. ensureUser for member provisioning
- access.ts: gateAccess DID membership gate (owner/role/visibility)
- merge-policy.ts: evaluateMergePolicy pure engine (reviews, reputation
  floor, checks, escrow, merge method, agent-merge toggle)
- service.ts: AgentGitService ties gate + policy to the adapter; refuses
  policy-failing merges; provisionMember hook for AgentBBS
- schemas: logicsrc-repo + logicsrc-pull-request, registered in
  @logicsrc/validators with fixtures
- docs/agentgit.md spec; plugin wired into root build (default/disabled)

27 vitest tests pass; full monorepo build green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugins/agentgit/README.md

@@ -0,0 +1,28 @@
+# AgentGit Plugin
+
+AgentGit is the agent-native source collaboration plugin for CommandBoard.run /
+LogicSRC. It is a thin, DID-gated layer over a git backend (Forgejo by default,
+GitHub or bare git/ssh via adapters) — **not** a new git host.
+
+The reference deployment is `git.profullstack.com`, a self-hosted Forgejo
+instance gated to BBS members. Callers authenticate with a LogicSRC DID
+(via `coinpay`), repos default to `members_only`, and pull requests merge by
+policy (`merge_policy`) rather than a human click.
+
+See `docs/agentgit.md` for the contract, architecture, and merge-policy rules.
+
+Schemas:
+
+```txt
+packages/schemas/schemas/logicsrc-repo.schema.json
+packages/schemas/schemas/logicsrc-pull-request.schema.json
+```
+
+Required environment:
+
+```txt
+AGENTGIT_API_URL
+AGENTGIT_FORGE_URL
+AGENTGIT_API_KEY
+AGENTGIT_WEBHOOK_SECRET
+```