feat: extract reforge engine into a standalone consumable flake

The forgejo-sandbox / reforge harness, lifted out of the machine config
into a host-agnostic, generic engine anyone can consume with Nix.

Two layers:
- engine (this repo) — nixosModules.reforge stands up the sandbox forge,
  provisions role accounts + tokens, enforces branch protection, and puts
  the reforge-* CLI + forgejo-mcp on PATH. Carries no project specifics.
- run config — per-project manifest/charter/agenda/issues an adopter fills
  in; scaffold one with the `reforge` flake template.

Portability fixes vs the in-config version:
- forgejo-mcp resolved from $REFORGE_MCP_BIN or PATH, never a named host
  (kills the nixosConfigurations.omni hardcode).
- all instance data + paths parameterized via REFORGE_* env, baked into the
  reforge-scripts wrappers from module options (configDir, agentsDir,
  refsDir, org, port, tokenOwner, ...).
- option namespace neutral (reforge.* not omni.packs.*); settings policies
  carry no absolute /etc/nixos paths.
- role briefs + orchestrator playbook genericized: all project specifics
  point at the charter; refs corpus optional.

Validated: nix flake check (eval) + builds of forgejo-mcp, reforge-scripts,
and a module-eval check.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/reforge/flake.nix

@@ -0,0 +1,51 @@
+{
+  description = "A reforge run configuration (manifest + charter + agenda), wiring the reforge engine as a NixOS module.";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+
+    # The reforge engine. Point this at wherever the engine lives — the
+    # aiolabs Forgejo by default; a GitHub mirror works the same way.
+    reforge.url = "git+https://git.atitlan.io/aiolabs/claude-forgejo-sandbox";
+    reforge.inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  outputs =
+    { self, nixpkgs, reforge }:
+    {
+      # Import this module into your NixOS host's module list. It turns on
+      # the sandbox forge and points it at THIS directory as the run config
+      # (manifest.txt / charter.md / agenda.md / issues.tsv live here).
+      #
+      #   # in your host config:
+      #   imports = [ inputs.myreforge.nixosModules.default ];
+      #
+      # Then `nixos-rebuild switch`, and you get the reforge-* CLI on PATH.
+      # See the engine's docs/reforge.md for the run lifecycle.
+      nixosModules.default =
+        { ... }:
+        {
+          imports = [ reforge.nixosModules.reforge ];
+
+          reforge = {
+            enable = true;
+            configDir = ./.;
+
+            # The local account that owns the generated token files and
+            # launches the per-role agent sessions. CHANGE THIS.
+            tokenOwner = "youruser";
+
+            # Roles to provision (one agent session each). There must be a
+            # brief <agentsDir>/<role>.md for every role here.
+            # roles = [ "backend-dev" "frontend-dev" "security-lead" "reviewer" ];
+
+            # Uncomment to customize the role briefs / orchestrator playbook
+            # instead of using the engine's generic ones:
+            # agentsDir = ./agents;
+
+            # Optional read-only reference corpus agents may cite:
+            # refsDir = "/home/youruser/refs";
+          };
+        };
+    };
+}