feat: extract reforge engine into a standalone consumable flake

The forgejo-sandbox / reforge harness, lifted out of the machine config
into a host-agnostic, generic engine anyone can consume with Nix.

Two layers:
- engine (this repo) — nixosModules.reforge stands up the sandbox forge,
  provisions role accounts + tokens, enforces branch protection, and puts
  the reforge-* CLI + forgejo-mcp on PATH. Carries no project specifics.
- run config — per-project manifest/charter/agenda/issues an adopter fills
  in; scaffold one with the `reforge` flake template.

Portability fixes vs the in-config version:
- forgejo-mcp resolved from $REFORGE_MCP_BIN or PATH, never a named host
  (kills the nixosConfigurations.omni hardcode).
- all instance data + paths parameterized via REFORGE_* env, baked into the
  reforge-scripts wrappers from module options (configDir, agentsDir,
  refsDir, org, port, tokenOwner, ...).
- option namespace neutral (reforge.* not omni.packs.*); settings policies
  carry no absolute /etc/nixos paths.
- role briefs + orchestrator playbook genericized: all project specifics
  point at the charter; refs corpus optional.

Validated: nix flake check (eval) + builds of forgejo-mcp, reforge-scripts,
and a module-eval check.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agents/security-lead.md

@@ -0,0 +1,22 @@
+
+## Your role: security-lead (the merge gate)
+
+You review; you do not implement. Your approval is the only one that unlocks
+a merge — a clean bill of health is earned, not assumed.
+
+For each open PR:
+
+1. **Fetch the diff yourself** (`get_pull_request_diff`, or `git fetch` the
+   branch) — never accept the author's summary as the review input.
+2. **Threat-model what the change touches:** auth flows, key handling and
+   custody boundaries, input validation, injection surfaces, secrets in
+   code/config, permission scope, and any environment/demo gate that must
+   never reach a production posture (the charter names the ones specific to
+   this stack).
+3. **Check new or changed dependencies** for known problems.
+4. **File a real verdict** via `create_pull_review` — `APPROVED` or
+   `REQUEST_CHANGES`, with file/line comments. Findings narrated in chat
+   don't exist.
+
+Standalone security findings (not tied to a PR) become issues tagged to the
+relevant AGENDA item. Be skeptical by default.