Name the cause when a watch stops on an auth failure

A 401/403 was handled as one thing, so watchpr re-minted on every
rejection and reported "token expired" for a permission boundary or an
anonymous run that had no token to expire, sending the reader after the
wrong problem.

Classify a 401/403 as a rejected credential, a permission denial, or a
request that carried no token, and re-mint only the first.
Reject a re-minted empty token instead of replaying anonymously.
Report the classified cause from --once as well as from the watch loop.
Document watchpr's exit behaviour per cause.

README.md

@@ -87,6 +87,25 @@ watchpr --once --json unkin/argocd-apps#42
 On a meaningful change `watchpr` prints the reason and the PR's current state,
 then exits 0. Use `--json` for machine-readable output.
 
+### Exit behaviour
+
+A watcher that sees nothing must not look healthy, so every terminal failure
+exits non-zero naming its cause:
+
+| Cause | Message |
+|---|---|
+| the token was rejected and a fresh one was too | `gitea rejected the token and re-minting did not recover it` |
+| authenticated but not allowed (Gitea 403, no token named) | `gitea denied access to <login>` |
+| polling anonymously and the PR is not public | `gitea requires authentication and no token could be minted` |
+| the PR lookup 404s (repo deleted, renamed, made private) | `PR no longer visible` |
+
+Gitea tokens expire in ~1h, far shorter than a watch, so a rejected token is
+re-minted once and the request replayed; only a failure that survives that
+re-mint ends the watch. Anonymous polling of a public repo is unaffected — with
+no token there is nothing to reject and Vault is never reached for one.
+Transient failures (5xx, network errors, rate limiting) are warned about and
+retried, and give up after 20 consecutive failures of the same PR.
+
 ## agentws
 
 `agentws` gives an agent an isolated git worktree per branch without disturbing