Let pushes go by an HTTPS token or an SSH deploy key

The push credential is either a push-only account's token, handed to git
through a credential helper that names environment variables, never
values, or a deploy key in a short-lived ssh-agent. The remote URL
follows the credential. Configured as gitea.push_user and push_token, or
gitea.push_key.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

tests/integration/nisse-test.yaml

@@ -42,3 +42,7 @@ gitea:
   token: ${NISSE_GITEA_TOKEN}
   repo: dongar/nisse-dev-testing-sandbox      # the sandbox, never a real project
   operators: [dongar]
+  # What pushes go by (D4): the sandbox's deploy key, whose private half CI
+  # writes to this path from the NISSE_PUSH_KEY secret (locally: copy it
+  # there). An HTTPS push token works too: push_user plus push_token.
+  push_key: /tmp/nisse-test/push_key