feat: extract reforge engine into a standalone consumable flake

The forgejo-sandbox / reforge harness, lifted out of the machine config
into a host-agnostic, generic engine anyone can consume with Nix.

Two layers:
- engine (this repo) — nixosModules.reforge stands up the sandbox forge,
  provisions role accounts + tokens, enforces branch protection, and puts
  the reforge-* CLI + forgejo-mcp on PATH. Carries no project specifics.
- run config — per-project manifest/charter/agenda/issues an adopter fills
  in; scaffold one with the `reforge` flake template.

Portability fixes vs the in-config version:
- forgejo-mcp resolved from $REFORGE_MCP_BIN or PATH, never a named host
  (kills the nixosConfigurations.omni hardcode).
- all instance data + paths parameterized via REFORGE_* env, baked into the
  reforge-scripts wrappers from module options (configDir, agentsDir,
  refsDir, org, port, tokenOwner, ...).
- option namespace neutral (reforge.* not omni.packs.*); settings policies
  carry no absolute /etc/nixos paths.
- role briefs + orchestrator playbook genericized: all project specifics
  point at the charter; refs corpus optional.

Validated: nix flake check (eval) + builds of forgejo-mcp, reforge-scripts,
and a module-eval check.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/settings/role-settings.json

@@ -0,0 +1,133 @@
+{
+  "enableAllProjectMcpServers": true,
+  "env": {
+    "GIT_SSH_COMMAND": "false"
+  },
+  "permissions": {
+    "defaultMode": "acceptEdits",
+    "allow": [
+      "Read",
+      "Glob",
+      "Grep",
+      "Edit",
+      "Write",
+      "NotebookEdit",
+
+      "mcp__forgejo-sandbox",
+
+      "Bash(git status)",
+      "Bash(git status:*)",
+      "Bash(git diff)",
+      "Bash(git diff:*)",
+      "Bash(git log)",
+      "Bash(git log:*)",
+      "Bash(git show)",
+      "Bash(git show:*)",
+      "Bash(git branch)",
+      "Bash(git branch:*)",
+      "Bash(git add:*)",
+      "Bash(git commit:*)",
+      "Bash(git checkout:*)",
+      "Bash(git switch:*)",
+      "Bash(git restore:*)",
+      "Bash(git stash)",
+      "Bash(git stash:*)",
+      "Bash(git rev-parse:*)",
+      "Bash(git merge:*)",
+      "Bash(git rebase:*)",
+      "Bash(git clone http://localhost:*)",
+      "Bash(git fetch)",
+      "Bash(git fetch origin:*)",
+      "Bash(git pull)",
+      "Bash(git pull origin:*)",
+      "Bash(git push)",
+      "Bash(git push origin:*)",
+      "Bash(git push --set-upstream origin:*)",
+      "Bash(git push -u origin:*)",
+      "Bash(git config user.name:*)",
+      "Bash(git config user.email:*)",
+
+      "Bash(nix build:*)",
+      "Bash(nix develop:*)",
+      "Bash(nix flake check:*)",
+      "Bash(nix flake show:*)",
+
+      "Bash(python3:*)",
+      "Bash(pytest:*)",
+      "Bash(uv run:*)",
+      "Bash(uv sync:*)",
+      "Bash(poetry run:*)",
+      "Bash(poetry install:*)",
+      "Bash(npm run:*)",
+      "Bash(npm test:*)",
+      "Bash(npm ci)",
+      "Bash(npm install)",
+      "Bash(pnpm run:*)",
+      "Bash(pnpm test:*)",
+      "Bash(pnpm install)",
+      "Bash(node:*)",
+      "Bash(make:*)",
+
+      "Bash(rg:*)",
+      "Bash(fd:*)",
+      "Bash(jq:*)",
+      "Bash(diff:*)",
+      "Bash(sort:*)",
+      "Bash(uniq:*)",
+      "Bash(find:*)",
+      "Bash(xargs:*)",
+      "Bash(mkdir:*)",
+      "Bash(touch:*)",
+      "Bash(ls:*)",
+      "Bash(pwd)",
+      "Bash(which:*)",
+      "Bash(type:*)",
+      "Bash(env)",
+      "Bash(echo:*)",
+      "Bash(file:*)",
+      "Bash(stat:*)",
+      "Bash(wc:*)",
+      "Bash(head:*)",
+      "Bash(tail:*)",
+      "Bash(cat:*)"
+    ],
+    "ask": [
+      "Bash(rm:*)",
+      "Bash(rmdir:*)",
+      "Bash(mv:*)",
+      "Bash(cp:*)",
+      "Bash(chmod:*)",
+      "Bash(chown:*)"
+    ],
+    "deny": [
+      "Bash(sudo:*)",
+      "Bash(sudo)",
+      "Bash(doas:*)",
+      "Bash(su:*)",
+      "Bash(nixos-rebuild:*)",
+      "Bash(nh:*)",
+      "Bash(nix run:*)",
+      "Bash(git remote:*)",
+      "Bash(git push ssh:*)",
+      "Bash(git push git@:*)",
+      "Bash(git push https:*)",
+      "Bash(git clone ssh:*)",
+      "Bash(git clone git@:*)",
+      "Bash(git clone https:*)",
+      "Bash(git fetch https:*)",
+      "Bash(git fetch ssh:*)",
+      "Bash(curl:*)",
+      "Bash(wget:*)",
+      "Bash(ssh:*)",
+      "Bash(scp:*)",
+      "Bash(rsync:*)",
+      "Bash(nc:*)",
+      "Bash(systemctl:*)",
+      "Bash(docker:*)",
+      "Bash(podman:*)",
+      "WebFetch",
+      "WebSearch",
+      "mcp__forgejo-mcp"
+    ]
+  }
+}