fix(agents): implement curl-based reviewer auth for MCP token limitation

The Forgejo MCP tools authenticate with a single server-level token that
cannot be overridden per-call. The PR Reviewer must use curl with
FORGEJO_REVIEWER_PAT for write operations (reviews, comments) to
authenticate as the reviewer account.

- pr-reviewer.md: added curl allow, denied MCP write tools, added
  curl-based review/comment API patterns with FORGEJO_REVIEWER_PAT
- pr-review-pool-supervisor.md: passes all 3 reviewer creds, documents
  READ-via-MCP/WRITE-via-curl split
- product-builder.md: passes FORGEJO_REVIEWER_PASSWORD to review pool

.opencode/agents/pr-review-pool-supervisor.md

@@ -411,10 +411,15 @@ LOOP FOREVER:
                 While you should check all standard items (spec compliance, tests, etc.),
                 pay SPECIAL ATTENTION to the focus areas above.
                 
-                CRITICAL: You MUST authenticate using the REVIEWER credentials for all
-                Forgejo API calls (reviews, comments). Use FORGEJO_REVIEWER_PAT and
-                FORGEJO_REVIEWER_USERNAME — NOT the primary bot credentials. This enables
-                formal APPROVED reviews on bot-created PRs.
+                CRITICAL — Dual-Account Authentication:
+                - READ operations (get PR, list reviews, get diff): Use the Forgejo MCP tools (primary bot token is fine for reads)
+                - WRITE operations (post review, post comment): Use curl with FORGEJO_REVIEWER_PAT
+                - CI log fetching: Pass reviewer web credentials to ci-log-fetcher
+                
+                Reviewer credentials (use these for ALL write operations via curl):
+                  FORGEJO_REVIEWER_PAT: $FORGEJO_REVIEWER_PAT
+                  FORGEJO_REVIEWER_USERNAME: $FORGEJO_REVIEWER_USERNAME
+                  FORGEJO_REVIEWER_PASSWORD: $FORGEJO_REVIEWER_PASSWORD
                 
                 Reference summary: {ref_summary}
                 """

.opencode/agents/pr-reviewer.md

@@ -14,6 +14,8 @@ permission:
   edit: deny
   bash:
     "*": deny
+    # Allow curl for reviewer-authenticated API calls (reviews, comments)
+    "curl *": allow
     # Block ALL commands that could hit the label creation endpoints
     "*api/v1/orgs/*/labels*": deny
     "*api/v1/repos/*/labels*": deny
@@ -24,6 +26,11 @@ permission:
     "ci-log-fetcher": allow
   forgejo:
     "*": allow
+    # WRITE operations that create reviews/comments MUST use curl with
+    # FORGEJO_REVIEWER_PAT instead of these MCP tools (which authenticate
+    # as the primary bot). These denies enforce that:
+    "forgejo_create_pull_review": deny
+    "forgejo_create_issue_comment": deny
     # CRITICAL: Label creation is COMPLETELY FORBIDDEN
     "forgejo_create_label": deny
     "forgejo_create_org_label": deny
@@ -426,7 +433,29 @@ Every review decision requires TWO actions performed in this order:
 
 **Why both?** The formal review (Step 1) is the standard Forgejo mechanism and the primary signal that merge automation checks. The issue comment (Step 2) provides a durable backup that is visible even if review UIs are filtered or collapsed, and enables human readers to see the full review rationale.
 
-**IMPORTANT: You MUST authenticate using the reviewer credentials**, not the primary bot credentials. Your caller (the PR Review Pool Supervisor) passes these as `FORGEJO_REVIEWER_PAT` and `FORGEJO_REVIEWER_USERNAME`. All your Forgejo API calls use these credentials.
+**IMPORTANT: Authentication Split — READ via MCP, WRITE via curl**
+
+The Forgejo MCP tools (`forgejo_get_pull_request_by_index`, `forgejo_list_pull_reviews`, etc.) authenticate as the PRIMARY bot account. This is fine for READ operations (getting PR details, diffs, existing reviews).
+
+However, WRITE operations (posting reviews and comments) MUST come from the REVIEWER account to enable formal APPROVED reviews. Since the MCP tools can't switch tokens, you MUST use curl with `FORGEJO_REVIEWER_PAT` for all writes:
+
+```bash
+# Post a formal review (APPROVED or REQUEST_CHANGES) — as reviewer account
+curl -s -X POST "https://git.cleverthis.com/api/v1/repos/{owner}/{repo}/pulls/{pr_number}/reviews" \
+  -H "Authorization: token $FORGEJO_REVIEWER_PAT" \
+  -H "Content-Type: application/json" \
+  -d '{"body": "<review body>", "event": "APPROVED"}'
+
+# Post a backup issue comment — as reviewer account
+curl -s -X POST "https://git.cleverthis.com/api/v1/repos/{owner}/{repo}/issues/{pr_number}/comments" \
+  -H "Authorization: token $FORGEJO_REVIEWER_PAT" \
+  -H "Content-Type: application/json" \
+  -d '{"body": "<comment body>"}'
+```
+
+Your caller (the PR Review Pool Supervisor) passes `FORGEJO_REVIEWER_PAT`, `FORGEJO_REVIEWER_USERNAME`, and `FORGEJO_REVIEWER_PASSWORD` in your prompt. When invoking `ci-log-fetcher`, pass the reviewer credentials as overrides: `forgejo_username: $FORGEJO_REVIEWER_USERNAME, forgejo_password: $FORGEJO_REVIEWER_PASSWORD`.
+
+**DO NOT use `forgejo_create_pull_review` or `forgejo_create_issue_comment` MCP tools** — these are denied in your permissions because they would authenticate as the primary bot, defeating the dual-account architecture.
 
 #### APPROVE
 

.opencode/agents/product-builder.md

@@ -796,9 +796,10 @@ launch_supervisor("pr-review-pool-supervisor", "reviewer-pool", "AUTO-REV-SUP",
     "You are the PR review pool supervisor.
      Repo: <owner>/<repo>. Instance ID: reviewer-pool-1.
      Forgejo PAT: <PAT>. Git: <name> <email>. Username: <username>. Password: <password>.
-     REVIEWER CREDENTIALS (for PR reviews): Reviewer PAT: <FORGEJO_REVIEWER_PAT>. Reviewer Username: <FORGEJO_REVIEWER_USERNAME>.
+     REVIEWER CREDENTIALS (for PR reviews): Reviewer PAT: <FORGEJO_REVIEWER_PAT>. Reviewer Username: <FORGEJO_REVIEWER_USERNAME>. Reviewer Password: <FORGEJO_REVIEWER_PASSWORD>.
      The reviewer account is a SEPARATE Forgejo user that can formally APPROVE PRs created by the primary bot.
-     Pass these reviewer credentials to every pr-reviewer subagent you dispatch.
+     Pass ALL THREE reviewer credentials to every pr-reviewer subagent you dispatch.
+     The PR Reviewer uses curl (not MCP tools) for write operations to authenticate as the reviewer.
      Max workers: N_HALF.
      When creating tracking issues, ALWAYS include these labels:
      Type/Automation, State/In Progress, Priority/Medium")