feat: extract reforge engine into a standalone consumable flake

The forgejo-sandbox / reforge harness, lifted out of the machine config
into a host-agnostic, generic engine anyone can consume with Nix.

Two layers:
- engine (this repo) — nixosModules.reforge stands up the sandbox forge,
  provisions role accounts + tokens, enforces branch protection, and puts
  the reforge-* CLI + forgejo-mcp on PATH. Carries no project specifics.
- run config — per-project manifest/charter/agenda/issues an adopter fills
  in; scaffold one with the `reforge` flake template.

Portability fixes vs the in-config version:
- forgejo-mcp resolved from $REFORGE_MCP_BIN or PATH, never a named host
  (kills the nixosConfigurations.omni hardcode).
- all instance data + paths parameterized via REFORGE_* env, baked into the
  reforge-scripts wrappers from module options (configDir, agentsDir,
  refsDir, org, port, tokenOwner, ...).
- option namespace neutral (reforge.* not omni.packs.*); settings policies
  carry no absolute /etc/nixos paths.
- role briefs + orchestrator playbook genericized: all project specifics
  point at the charter; refs corpus optional.

Validated: nix flake check (eval) + builds of forgejo-mcp, reforge-scripts,
and a module-eval check.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/reforge/manifest.txt

@@ -0,0 +1,25 @@
+# Reforge run manifest — read by reforge-seed and reforge-compare.
+#
+#   name|kind|upstream|base_ref|target_url|target_ref
+#
+# kind      fork     = sandbox repo seeded from `upstream` at `base_ref`
+#           original = empty placeholder repo (your own software)
+# base_ref  branch, tag, or commit SHA of the upstream to seed as `main`.
+#           "auto" = upstream default-branch tip — convenient for exploring,
+#           NOT reproducible: pin every fork before a real run.
+# target_*  the known working state (real repo + branch) the run must
+#           reproduce byte-for-byte. NEVER pushed into the sandbox — only
+#           reforge-compare reads it, and reforge-fetch-targets mirrors it
+#           for Phase B. "-" = not declared (compare skips the repo).
+#
+# Changing base_ref does not re-seed an existing repo (seeding is
+# skip-if-pushed) — reset the sandbox first (reforge-reset reset).
+#
+# ── EXAMPLE ROWS (replace with your stack) ────────────────────────────
+# A fork seeded from a pinned upstream commit, no target declared yet:
+hello|fork|https://github.com/octocat/Hello-World|7fd1a60b01f91b314f59955a4e4d4e80d8edf11d|-|-
+
+# Your own software: an empty placeholder to rebuild from recorded intent.
+# Declare a target once you have a known-working branch to converge to:
+myapp|original|-|-|-|-
+# myapp|original|-|-|git@github.com:you/myapp|main