hive-forge: ci-rerun dispatches a fresh run via workflow-dispatch API

The previous implementation POSTed Forgejo's run-page rerun web route,
which is CSRF-gated and answers a bare token POST with 404 — so the verb
never actually re-ran anything against the agent token.

Rework it to dispatch a fresh run of the workflow via the
GitHub-compatible workflow-dispatch API
(POST /repos/<o>/<r>/actions/workflows/<workflow>/dispatches {"ref":<branch>}),
which accepts a plain agent token (verified end-to-end on Forgejo 15.0.3).
A dispatched run is equivalent to the old empty-commit retrigger, minus
the commit.

The branch is resolved from exactly one of --pr (the PR head branch),
--run (branch + workflow looked up from that run in the Actions runs
list), or --branch (directly); --workflow picks the workflow file for
--pr/--branch (default ci.yml). Dispatch re-runs the whole workflow, so
the old --job single-job variant is dropped.

Also add workflow_dispatch to .forgejo/workflows/ci.yml for explicitness
(Forgejo 15.0.3 dispatches the pull_request workflow without it, but the
trigger makes the API path intent-clear and cross-version robust), remove
the now-unused Client::post_web_no_content, and update docs/tools/forge.md.

docs/tools/forge.md

@@ -76,7 +76,7 @@ hive-forge attach-comment 18042 /path/to/file  # upload a file attachment to a c
 hive-forge attachment-get <uuid>            # download an attachment; prints resolved path to stdout
 hive-forge artifact-get pr1ma-paper-pdf --run 51  # download a CI run's Actions artifact zip (run number from the run-page URL)
 hive-forge ci-log --run 51                   # print a CI run's job step logs (run number from the run-page URL); --job i / --step i to narrow
-hive-forge ci-rerun --run 51                  # re-run a CI run without an empty commit (--pr n resolves the head run; --job i re-runs one job)
+hive-forge ci-rerun --pr 42                   # re-run CI without an empty commit (dispatches a fresh run; --run n / --branch name also work)
 hive-forge subscription --watch             # subscribe to repo notifications
 hive-forge subscription --unwatch           # unsubscribe
 hive-forge -r internal/knowledge clone      # clone with creds auto-injected
@@ -173,12 +173,17 @@ plain comment show under `last comment`, not `reviews`.
   is reliable for live + recently-finished runs; when logs are gone the
   verb says so rather than printing nothing. `--json` dumps the raw
   run-view response.
-- `ci-rerun --run <n> [--job i]` re-runs a CI Actions run without
-  pushing an empty commit (the old retrigger path, which littered PR
-  history). `<n>` is the same run number `ci-log` / `artifact-get` take;
-  `--pr <n>` resolves the run from a PR head sha's CI status instead.
-  `--job i` re-runs a single job (0-based); omit to re-run all jobs.
-  Forgejo exposes no REST endpoint, so it POSTs the run page's rerun web
-  route (which answers with a redirect, not JSON).
+- `ci-rerun` re-runs CI without pushing an empty commit (the old
+  retrigger path, which littered PR history). Forgejo has no token-usable
+  REST endpoint to re-run an *existing* run (the run-page rerun buttons
+  are CSRF-gated web routes a token POST 404s), so this dispatches a
+  **fresh** run of the workflow via the workflow-dispatch API
+  (`POST …/actions/workflows/<workflow>/dispatches {"ref":"<branch>"}`).
+  Resolve the branch with exactly one of: `--pr <n>` (the PR's head
+  branch), `--run <n>` (the same run number `ci-log` / `artifact-get`
+  take — resolves the branch + workflow from that run), or `--branch
+  <name>` (directly). `--workflow <file>` picks the workflow file for
+  `--pr` / `--branch` (default `ci.yml`). Dispatch re-runs the whole
+  workflow — there is no single-job variant.
 - Do NOT use raw `curl` for forge access -- the CLI handles auth,
   error checking, and output formatting.