swarm-controller: the builder's forge calls re-read the token on refusal too

#5177 added five forge requests under the controller's token that went
straight to the forgejo client: the commit status in
`Client::create_commit_status`, and in `forge/builder_account.rs` the
hives-team add, the user read, the repo-creation lockdown and the team
membership read. Each now goes through `Api::call`, so a 401 re-reads
the token from the store and sends the request once more, like the
other controller forge calls.

The read-back of the builder's newly minted token in
`ensure_builder_forge_token` stays a direct client: it sends the
builder's own token, not the controller's, the same as the read-backs
in `agent_token`, `classifier_account` and `hive_token`.

swarm-controller/src/forge.rs

@@ -1214,18 +1214,17 @@ impl Client {
         state: CommitStatusState,
         description: &str,
     ) -> Result<()> {
+        let status = CreateStatusOption {
+            context: Some(context.to_owned()),
+            description: Some(status_description(description)),
+            state: Some(state),
+            target_url: None,
+        };
         self.api
-            .repo_create_status(
-                owner,
-                repo,
-                sha,
-                CreateStatusOption {
-                    context: Some(context.to_owned()),
-                    description: Some(status_description(description)),
-                    state: Some(state),
-                    target_url: None,
-                },
-            )
+            .call(|api| {
+                api.repo_create_status(owner, repo, sha, status.clone())
+                    .into_future()
+            })
             .await
             .with_context(|| format!("set the {context} status on {sha} of {owner}/{repo}"))?;
         Ok(())