feat(#1399): hive-forge clone verb + pr-create --agit for no-fork PRs

hive-forge/src/client.rs

@@ -23,6 +23,10 @@ const DEFAULT_REPO: &str = "hyperhive/hyperhive";
 pub struct Client {
     http: HttpClient,
     base: String,
+    /// Per-agent forge token. Kept alongside the pre-built auth header
+    /// so verbs that shell out to `git` (e.g. `knowledge`) can assemble
+    /// an authenticated push URL without re-reading the token file.
+    token: String,
     /// Default repo used when a verb doesn't carry an explicit
     /// `[repo]` override.
     pub default_repo: String,
@@ -59,11 +63,29 @@ impl Client {
         Ok(Self {
             http,
             base,
+            token,
             default_repo,
             json_mode,
         })
     }
 
+    /// Assemble an authenticated git URL for `repo` (e.g.
+    /// `internal/knowledge`) by injecting the agent's forge user +
+    /// token into the base URL's authority: `http://<user>:<token>@host/<repo>.git`.
+    /// The user comes from `HIVE_LABEL` (the agent's forge login),
+    /// falling back to `oauth2` which Forgejo also accepts as the
+    /// token-bearer username. Used by `knowledge` to clone/push.
+    #[must_use]
+    pub fn authed_git_url(&self, repo: &str) -> String {
+        let user = std::env::var("HIVE_LABEL").unwrap_or_else(|_| "oauth2".to_owned());
+        // Split scheme from authority so credentials land in the right spot.
+        let (scheme, host) = self
+            .base
+            .split_once("://")
+            .unwrap_or(("http", self.base.as_str()));
+        format!("{scheme}://{user}:{}@{host}/{repo}.git", self.token)
+    }
+
     /// True when the operator passed the global `--json` flag.
     /// Verbs that have a human-readable default branch on this to
     /// emit JSON instead. Verbs whose only output format is JSON