Let pushes go by an HTTPS token or an SSH deploy key

The push credential is either a push-only account's token, handed to git
through a credential helper that names environment variables, never
values, or a deploy key in a short-lived ssh-agent. The remote URL
follows the credential. Configured as gitea.push_user and push_token, or
gitea.push_key.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

.gitea/workflows/ci.yml

@@ -42,6 +42,15 @@ jobs:
       - name: Unit tests
         run: uv run pytest -m "not integration"
 
+      - name: Push key
+        # The sandbox's deploy key, where nisse-test.yaml expects it.
+        env:
+          NISSE_PUSH_KEY: ${{ secrets.NISSE_PUSH_KEY }}
+        run: |
+          mkdir -p /tmp/nisse-test
+          printf '%s\n' "$NISSE_PUSH_KEY" > /tmp/nisse-test/push_key
+          chmod 600 /tmp/nisse-test/push_key
+
       - name: Integration tests
         # Everything but the secrets is in tests/integration/nisse-test.yaml,
         # which refers to these by name. A missing secret fails the live
@@ -50,6 +59,4 @@ jobs:
           NISSE_LLM_TOKEN: ${{ secrets.NISSE_LLM_TOKEN }}
           NISSE_MATRIX_TOKEN: ${{ secrets.NISSE_MATRIX_TOKEN }}
           NISSE_GITEA_TOKEN: ${{ secrets.NISSE_GITEA_TOKEN }}
-          # The sandbox's deploy key (private half), which pushes go by (D4).
-          NISSE_PUSH_KEY: ${{ secrets.NISSE_PUSH_KEY }}
         run: uv run pytest -m integration -rs