apply_config_repo_branch_protection treated 200/409/422 from the
create-branch-protection POST all as success. But a 422 means Forgejo
*rejected* the request and created no rule — so a rejected POST silently
left the agent's config repo unprotected, with nothing logged (a new
agent's config repo was found with no main-branch protection and no
trace of why).
Don't trust the status code:
- On any non-201, GET the single .../branch_protections/main rule and
only treat it as success if the rule is actually present.
- Otherwise return Err carrying the POST's response body, so the real
Forgejo rejection reason lands in the host journal. (forge_http
discarded the body; added forge_http_full that returns it.)
ensure_config_repo runs on every sync_agent sweep (startup + each
rebuild), so a now-Err result is logged and retried next sweep —
self-healing once a real cause is fixed. Net: the failure is loud +
retried instead of silently swallowed.
nix fmt clean.
512e9ff09f