🔒 security(ci): keep sync token out of remote url via GIT_ASKPASS

- inline .gitea/ci/sync_tsl_playbook.sh into sync-tsl-playbook.yml
- clone over plain repo url; credentials flow through an ephemeral
  GIT_ASKPASS helper removed in cleanup
- rewrite tests to extract and exercise the workflow run block

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/ci/sync_tsl_playbook.sh

@@ -1,80 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Build the minimal TSL playbook bundle and publish its *expanded* contents to
-# the tsl-playbook branch. The branch tree mirrors the bundle root directly
-# (AGENTS.md, docs/, skills/) — there is no wrapping tsl-playbook/ directory.
-#
-# Only the paths produced by the bundle are managed. Any other file that lives
-# on the branch (e.g. a hand-written README.md) is preserved across syncs.
-
-REPO_DIR="${REPO_DIR:-$(pwd)}"
-TARGET_BRANCH="${TARGET_BRANCH:-tsl-playbook}"
-BUILD_SCRIPT="${BUILD_SCRIPT:-scripts/build_tsl_playbook.py}"
-COMMIT_AUTHOR_NAME="${COMMIT_AUTHOR_NAME:-ci[bot]}"
-COMMIT_AUTHOR_EMAIL="${COMMIT_AUTHOR_EMAIL:-ci-bot@local}"
-
-cd "$REPO_DIR"
-
-git config user.name "$COMMIT_AUTHOR_NAME"
-git config user.email "$COMMIT_AUTHOR_EMAIL"
-
-source_sha="$(git rev-parse HEAD)"
-source_short="$(git rev-parse --short HEAD)"
-
-# Build the bundle into a temp dir *outside* the repo so that resetting the
-# target branch's working tree can never clobber the freshly built artifact.
-build_dir="$(mktemp -d)"
-cleanup() {
-  rm -rf "$build_dir"
-}
-trap cleanup EXIT
-
-bundle="$build_dir/tsl-playbook"
-python3 "$BUILD_SCRIPT" --output "$bundle"
-
-# These are the only paths this workflow owns on the branch. Everything else is
-# left alone, including hand-written files such as README.md.
-generated_paths=(AGENTS.md docs skills)
-for path in "${generated_paths[@]}"; do
-  if [ ! -e "$bundle/$path" ]; then
-    echo "ERROR: bundle is missing expected path: $path" >&2
-    exit 1
-  fi
-done
-
-# Check out (or create) the target branch.
-if git show-ref --verify --quiet "refs/remotes/origin/$TARGET_BRANCH"; then
-  git fetch origin "$TARGET_BRANCH"
-  git checkout -B "$TARGET_BRANCH" "origin/$TARGET_BRANCH"
-else
-  # A brand-new orphan branch inherits main's index. Clear the index without
-  # deleting source files from the working tree; only generated_paths are staged.
-  git checkout --orphan "$TARGET_BRANCH"
-  git rm -rf --cached --quiet . >/dev/null 2>&1 || true
-fi
-
-# Remove only generated paths before copying the freshly built bundle.
-rm -rf "${generated_paths[@]}"
-
-# Copy bundle contents (including dotfiles) to the repo root.
-cp -R "$bundle"/. "$REPO_DIR"/
-
-git add -A "${generated_paths[@]}"
-
-if git diff --cached --quiet; then
-  echo "No tsl-playbook changes to publish."
-  exit 0
-fi
-
-git commit -m ":package: deps(tsl): sync tsl-playbook from ${source_short}
-
-Source-Commit: ${source_sha}"
-
-TOKEN="${WORKFLOW:-}"
-if [ -n "$TOKEN" ] && [ -n "${GITHUB_SERVER_URL:-}" ] && [ -n "${GITHUB_REPOSITORY:-}" ]; then
-  git remote set-url origin "https://oauth2:${TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git"
-fi
-
-git push origin "$TARGET_BRANCH"
-echo "✅ Published tsl-playbook @ ${source_short}"