feat(pm-agent): pin the first published agent-runner digest, start dry, and fix the token scopes

Rebased #61 onto the CI image pipeline (#81). This commit makes the remaining in-git
blockers to going live go away:

- deployment.yaml and PM_WORKER_IMAGE pin images run 340's digest (sha256:c4eba5b3...,
  tag sha-523cd9118f95 = main), read from the registry. Renovate markers unchanged.
- PM_DRY_RUN=true and PM_REQUIRE_LABEL=agent for the first run. Dry run is required, not
  just cautious: the run-340 image's baked worker template predates imagePullSecrets, so
  admission would deny its Jobs until CI re-publishes after this merge and Renovate bumps.
- Token scopes: Gitea 1.24.3 scopes GET /api/v1/user (the dispatcher's first call) under
  read:user. The documented list was missing it. Now read:user, write:repository,
  write:issue, read:package everywhere.
- Org-package read documented as a team (Packages=Read, no repos), not just a scope.
- sops is toolbox-only; the .examples say so and give the in-place edit.
- runbook: key-name check no longer emits Secret values before the pipe.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/pm-agent/configmap.yaml

@@ -51,15 +51,20 @@ data:
   # the dispatcher and its workers share the committed Job template and the env-name
   # contract. A tag here is refused at startup (and would be DENIED by admission anyway).
   #
-  # PLACEHOLDER UNTIL THE IMAGE IS PUBLISHED. The all-zero digest below is deliberately
-  # impossible. CI builds, verifies and — on main — publishes agent-runner
-  # (.gitea/workflows/images.yaml), and Renovate replaces this value with the digest the
-  # REGISTRY returned for the image's `main` tag, in a pull request that also moves the
-  # Deployment's image (same marker, same branch). Nobody pushes this image from a workstation.
-  # Until the first publish the dispatcher starts, fails to pull, and says so — which is the
-  # visible failure, not a silent one.
+  # THE FIRST PUBLISHED DIGEST. CI builds, verifies and — on main — publishes agent-runner
+  # (.gitea/workflows/images.yaml). This value is images run 340's publish (tag
+  # sha-523cd9118f95, which `main` pointed at), read from the registry on 2026-10-30. From here
+  # on Renovate replaces it with the digest the REGISTRY returns for the `main` tag, in a pull
+  # request that also moves the Deployment's image (same marker, same branch). Nobody pushes
+  # this image from a workstation.
+  #
+  # READ BEFORE TURNING PM_DRY_RUN OFF: this digest PREDATES the worker template's
+  # `imagePullSecrets` entry (PR #61). Its baked template has none, and admission now REQUIRES
+  # it — so a worker Job built from this image is DENIED. The merge that adds the entry
+  # changes infra/agent/**, CI re-publishes agent-runner, and Renovate's bump to that digest
+  # is what makes worker Jobs admissible. Until then, dry run is the only mode that works.
   # renovate-digest: image=gitea.home.keithjackson.dev/home-network/agent-runner tag=main
-  PM_WORKER_IMAGE: "gitea.home.keithjackson.dev/home-network/agent-runner@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+  PM_WORKER_IMAGE: "gitea.home.keithjackson.dev/home-network/agent-runner@sha256:c4eba5b3c508bf456a03391ac76f8275e7ea28a829da1450d99f6f6f25c6eb42"
 
   # --- the model -------------------------------------------------------------
   # The PM only reads a thread and answers with one JSON object, so it holds no tools and
@@ -104,13 +109,21 @@ data:
   # work somebody deliberately handed it while trust is being established, with no code
   # change and no redeploy of anything but this ConfigMap. The operator's call; the default
   # here honours the request as made.
-  PM_REQUIRE_LABEL: ""
+  #
+  # SET TO `agent` FOR THE FIRST RUN (2026-10-30, docs/plans/pm-agent-issue-to-pr.md
+  # follow-up 3). The label does not exist in the repository yet: create it in Gitea
+  # (Issues -> Labels -> New Label, name `agent`) before labelling a test issue.
+  PM_REQUIRE_LABEL: "agent"
 
   # Dry run: the PM still reads threads, still asks the model and still posts its decision as
   # an issue comment — so the operator can read exactly what it WOULD have done — but creates
   # no worker Job and so changes no code. The honest way to watch this service for a day
   # before letting it write anything.
-  PM_DRY_RUN: "false"
+  #
+  # "true" FOR THE FIRST RUN, and not only for caution: the pinned digest above cannot yet
+  # create an admissible worker Job (see the PM_WORKER_IMAGE comment). Flip to "false" in the
+  # same pull request as — or after — Renovate's first agent-runner digest bump.
+  PM_DRY_RUN: "true"
 
   # If the gate refuses a worker's change, the branch is NOT pushed by default and the issue
   # gets the gate log instead. Set to "true" to push anyway and open a red pull request —