Add AgentGit M1: agent-native git layer over a Forgejo backend

AgentGit is a thin, DID-gated source-collaboration layer over a backend
forge (default Forgejo at git.profullstack.com, BBS-members-only) — not a
new git host. M1 implements the contract and engines:

- forge/adapter.ts: ForgeAdapter interface (only forge-specific surface)
- forge/forgejo.ts: ForgejoAdapter over Forgejo/Gitea REST v1 (injectable
  fetch, typed errors), incl. ensureUser for member provisioning
- access.ts: gateAccess DID membership gate (owner/role/visibility)
- merge-policy.ts: evaluateMergePolicy pure engine (reviews, reputation
  floor, checks, escrow, merge method, agent-merge toggle)
- service.ts: AgentGitService ties gate + policy to the adapter; refuses
  policy-failing merges; provisionMember hook for AgentBBS
- schemas: logicsrc-repo + logicsrc-pull-request, registered in
  @logicsrc/validators with fixtures
- docs/agentgit.md spec; plugin wired into root build (default/disabled)

27 vitest tests pass; full monorepo build green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugins/agentgit/src/index.ts

@@ -0,0 +1,70 @@
+import type { PluginDefinition } from "@logicsrc/plugin-core";
+import { agentGitManifest } from "./manifest.js";
+
+export const agentGitPlugin: PluginDefinition = {
+  manifest: agentGitManifest,
+  configDefaults: {
+    enabled: false,
+    backend_provider: "forgejo",
+    forge_url: "${AGENTGIT_FORGE_URL}",
+    api_url: "${AGENTGIT_API_URL}",
+    api_key: "${AGENTGIT_API_KEY}",
+    webhook_secret: "${AGENTGIT_WEBHOOK_SECRET}",
+    members_only: true,
+    default_merge_policy: {
+      min_reviews: 1,
+      require_passing_checks: true,
+      reviewer_reputation_min: 0,
+      escrow_required: false,
+      allow_agent_merge: true,
+      allowed_merge_methods: ["squash"]
+    }
+  },
+  routes: [
+    { method: "POST", path: "/api/plugins/agentgit/repos", capability: "repo.create" },
+    { method: "GET", path: "/api/plugins/agentgit/repos", capability: "repo.list" },
+    { method: "POST", path: "/api/plugins/agentgit/repos/:repo/pulls", capability: "pr.open" },
+    { method: "POST", path: "/api/plugins/agentgit/repos/:repo/pulls/:number/reviews", capability: "pr.review" },
+    { method: "POST", path: "/api/plugins/agentgit/repos/:repo/pulls/:number/merge", capability: "pr.merge" },
+    { method: "POST", path: "/api/plugins/agentgit/webhooks/push", capability: "webhook.push" },
+    { method: "POST", path: "/api/plugins/agentgit/webhooks/pr-status", capability: "webhook.pr_status" }
+  ],
+  events: [
+    { event: "task.claimed", capability: "branch.create" },
+    { event: "pull_request.merged", capability: "reputation.merge_event" }
+  ],
+  permissions: [
+    "repos:read",
+    "repos:create",
+    "pulls:open",
+    "pulls:review",
+    "pulls:merge"
+  ],
+  tuiPanels: [{ id: "agentgit-status", title: "AgentGit" }]
+};
+
+export { agentGitManifest };
+
+// M1: Forgejo adapter, membership gate, merge-policy engine, and service.
+export * from "./domain.js";
+export * from "./access.js";
+export * from "./merge-policy.js";
+export * from "./service.js";
+export type {
+  ForgeAdapter,
+  ForgeRepo,
+  ForgeBranch,
+  ForgeReview,
+  ForgeCheck,
+  ForgePullRequest,
+  ForgeUser,
+  CreateRepoInput,
+  CreateBranchInput,
+  OpenPullRequestInput,
+  AddReviewInput,
+  MergePullRequestInput,
+  MergeResult,
+  EnsureUserInput
+} from "./forge/adapter.js";
+export { ForgejoAdapter, ForgejoApiError } from "./forge/forgejo.js";
+export type { FetchLike, ForgejoAdapterOptions } from "./forge/forgejo.js";