Make the Vault gitea creds path selectable

agentpr always read gitea/creds/unkin-agent from a bare const, so a service
like repospawner could not run it as its own Gitea identity.

- Replace the GiteaCredsPath const with a function: GITEA_CREDS_PATH when set,
  otherwise gitea/creds/<AGENT_LOGIN>. Unset env still resolves to
  gitea/creds/unkin-agent, so existing callers are unchanged.
- Thread the creds path through fetchGiteaToken/readGiteaCreds instead of
  reading a package-level const, and report it in the error messages.
- Make agentpr's help text login-agnostic and document both variables.

README.md

@@ -1,11 +1,12 @@
 # agent-tools
 
 Small Gitea-automation CLIs, shipped together in one RPM (`agent-tools`). They
-act as the **`unkin-agent`** user by minting a scoped Gitea token from Vault, so
-automated PRs, comments and pushes are attributed to the agent — not to whoever
-happens to run the command.
+act as an agent user (**`unkin-agent`** by default) by minting a scoped Gitea
+token from Vault, so automated PRs, comments and pushes are attributed to the
+agent — not to whoever happens to run the command. Set `AGENT_LOGIN` to act as a
+different agent identity.
 
-- **`agentpr`** — create pull requests and post PR comments as `unkin-agent`.
+- **`agentpr`** — create pull requests and post PR comments as the agent user.
 - **`watchpr`** — poll one or more PRs and exit when one changes in a way worth
   acting on.
 - **`agentws`** — manage per-branch git worktrees for `unkin-agent`, cloning
@@ -16,8 +17,9 @@ happens to run the command.
 ## How it gets a token
 
 On first use each tool performs a Vault AppRole login (`role_id` only, no
-`secret_id`), then reads `gitea/creds/unkin-agent` to obtain a short-lived Gitea
-token, cached in-process for the run.
+`secret_id`), then reads `gitea/creds/$AGENT_LOGIN` — or `GITEA_CREDS_PATH` when
+set — to obtain a short-lived Gitea token, cached in-process for the run. With
+neither variable set that is `gitea/creds/unkin-agent`, as before.
 
 Everything is configured by environment variables, all with defaults:
 
@@ -26,7 +28,8 @@ Everything is configured by environment variables, all with defaults:
 | `VAULT_ADDR` | `https://vault.service.consul:8200` | Vault/OpenBao address |
 | `AGENT_APPROLE_ROLE_ID` | built-in default | AppRole role_id (overridable) |
 | `GITEA_URL` | `https://git.unkin.net` | Gitea base URL |
-| `AGENT_LOGIN` | `unkin-agent` | login whose comments `watchpr` ignores |
+| `AGENT_LOGIN` | `unkin-agent` | agent identity: selects `gitea/creds/<login>`, and the login whose comments `watchpr` ignores |
+| `GITEA_CREDS_PATH` | `gitea/creds/$AGENT_LOGIN` | Vault path minting the Gitea token (wins over `AGENT_LOGIN`) |
 | `AGENTWS_SRC_ROOT` | `~/src/prodenv` | source-of-truth checkout root (`agentws`) |
 | `AGENTWS_ROOT` | `~/.cache/agentws` | worktree root (`agentws`) |
 | `AGENTWS_OWNER` | `unkin` | Gitea org that owns the repos (`agentws`) |
@@ -35,7 +38,7 @@ Everything is configured by environment variables, all with defaults:
 ## agentpr
 
 ```bash
-# Verify identity (should print: unkin-agent)
+# Verify identity (prints the agent login, unkin-agent by default)
 agentpr whoami
 
 # Open a PR
@@ -101,7 +104,7 @@ agentws rm ~/.cache/agentws/argocd-apps__benvin-my-change --delete-branch
 # Remove every managed worktree and prune each source repo
 agentws clean
 
-# Print a fresh unkin-agent Gitea token
+# Print a fresh Gitea token for the agent login
 agentws token
 ```
 
@@ -113,7 +116,7 @@ persists one in a remote URL or in git config. Instead it wires itself as an
 
 - `agentws token` prints a fresh token to stdout (handy for scripts).
 - `agentws credential get` speaks the git credential protocol on stdin and, for
-  the configured Gitea host only, emits `username=unkin-agent` +
+  the configured Gitea host only, emits `username=$AGENT_LOGIN` +
   `password=<fresh token>`.
 
 `agentws new` sets this up per worktree without touching the shared checkout: it