Replace ~600 chars of verbatim per-agent boilerplate with skill references.
All 91 agents now load cleveragents-agent-rules for exhaustive pagination,
label management, bot signatures, and credential flow rules. Adds explicit
skill: "*": deny + targeted allows to every agent permission block, matching
the existing bash: and task: deny-first convention. Tier selectors carry no
skill permissions since they are pure pass-through with no skill references
in their bodies. forgejo-label-manager also grants forgejo-api for its curl
pattern reference.
- Block REST API endpoints for label creation at the bash level for all agents.
- Restrict `forgejo_create_label` and related MCP tools for all agents.
- Restrict `forgejo_add_issue_labels` to only the `forgejo-label-manager`.
- Ensure all label operations are centralized through the `forgejo-label-manager`.
- Update agent definitions to use the label manager instead of direct API calls or MCP tools for adding labels.
This prevents agents from creating new project-level labels and enforces the use of organization-level labels, resolving the issue of duplicate labels being created.