Let pushes go by an HTTPS token or an SSH deploy key

The push credential is either a push-only account's token, handed to git
through a credential helper that names environment variables, never
values, or a deploy key in a short-lived ssh-agent. The remote URL
follows the credential. Configured as gitea.push_user and push_token, or
gitea.push_key.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/src/nisse_dev/config.py

@@ -55,6 +55,8 @@ OPTIONAL_KEYS = (
     "llm.request_timeout_s",
     "gitea.base_branch",
     "gitea.push_key",
+    "gitea.push_user",
+    "gitea.push_token",
     "build_host.user",
     "build_host.port",
 )
@@ -241,9 +243,12 @@ class AgentConfig:
     gitea_operators: frozenset[str]
     build_host: BuildHost
     base_branch: str = "main"
-    # The key that may push to the project repository, handed to each push on
-    # the build VM and to nothing else (D4).
+    # What may push to the project repository, handed to each push on the
+    # build VM and to nothing else (D4): a push-only account's HTTPS token
+    # (push_user, push_token), or the path to a deploy key (push_key).
     push_key: Path | None = None
+    push_user: str | None = None
+    push_token: str | None = None
     max_output_tokens: int = DEFAULT_MAX_OUTPUT_TOKENS
     request_timeout_s: float = DEFAULT_REQUEST_TIMEOUT_S
     tuning: Tuning = field(default_factory=Tuning)
@@ -331,6 +336,12 @@ class AgentConfig:
                 raise ValueError
         except (TypeError, ValueError):
             errors.append("build_host.port: must be a TCP port number")
+        push_user = values.get("gitea.push_user")
+        push_token = values.get("gitea.push_token")
+        if bool(push_user) != bool(push_token):
+            errors.append("gitea.push_user and gitea.push_token: set both or neither")
+        if push_token and values.get("gitea.push_key"):
+            errors.append("gitea: set a push token or a push key, not both")
         if errors:
             raise ConfigError("cannot start: " + "; ".join(errors))
 
@@ -365,6 +376,8 @@ class AgentConfig:
                 port=port,
             ),
             push_key=Path(push_key).expanduser() if push_key else None,
+            push_user=str(push_user) if push_user else None,
+            push_token=str(push_token) if push_token else None,
             base_branch=str(values.get("gitea.base_branch") or "main"),
             max_output_tokens=max_output,
             request_timeout_s=request_timeout,