Let pushes go by an HTTPS token or an SSH deploy key

The push credential is either a push-only account's token, handed to git
through a credential helper that names environment variables, never
values, or a deploy key in a short-lived ssh-agent. The remote URL
follows the credential. Configured as gitea.push_user and push_token, or
gitea.push_key.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/tests/test_publish.py

@@ -6,7 +6,7 @@ from typing import Any
 import pytest
 
 from nisse_dev.execution import SSHHost
-from nisse_dev.git import GitRepo
+from nisse_dev.git import GitRepo, HTTPSToken
 from nisse_dev.gitea import GiteaError, PullRequest
 from nisse_dev.oplog import OpLog
 from nisse_dev.publish import OPEN_PR_INTENT, MilestonePublisher
@@ -77,7 +77,7 @@ class FakeGit:
         return self.repo.commits_since(ref)
 
     def remote_sha(
-        self, remote_url: str, branch: str, *, key: str | None = None
+        self, remote_url: str, branch: str, *, credential: object = None
     ) -> str | None:
         return self.remote.get(branch)
 
@@ -90,7 +90,7 @@ class FakeGit:
     def commit_all(self, message: str) -> str | None:
         return self.repo.commit_all(message)
 
-    def push(self, remote_url: str, branch: str, *, key: str | None = None) -> None:
+    def push(self, remote_url: str, branch: str, *, credential: object = None) -> None:
         self.pushed.append(branch)
         self.remote[branch] = self.repo.head_sha()
 
@@ -111,7 +111,7 @@ def build(store: StateStore, git: Any, client: Any) -> MilestonePublisher:
         "o/sandbox",
         git,
         remote_url="ssh://git@gitea.test/o/sandbox.git",
-        push_key="KEY",
+        push_credential=HTTPSToken("pusher", "tok"),
     )