Add unkin-agent Gitea identity with write but no merge

Why: AI coding agents currently push and open PRs as Ben's own account
using Ben's token, so their work is unattributable and carries Ben's full
owner privileges. A dedicated least-privilege identity separates agent work
from Ben's and keeps merge a human decision.

How:
- add the unkin-agent bot user (non-admin, no org/repo creation, limited
  visibility); it authenticates via ephemeral vault-plugin-secrets-gitea
  tokens, not a stored password
- add the agents team granting Write on all unkin repositories, the minimum
  needed to push branches and open PRs; unkin-agent is its only member
- add merge_whitelist_teams Owners to every default-branch protection rule
  that lacked a merge whitelist, so Write no longer implies merge and only
  Owners (Ben) can merge across the estate

config/git.unkin.net/unkin/team/agents.yaml

@@ -0,0 +1,14 @@
+# Grants the unkin-agent bot Write across every unkin repository so Ben's AI
+# coding agents can push benvin/* branches and open pull requests. Write is the
+# minimum Gitea permission that allows pushing branches + creating PRs.
+#
+# Merge stays reserved for Ben: branch protection on every default branch sets a
+# merge whitelist of the Owners team only, so members of this team can push and
+# open PRs but cannot merge or approve. Keep this team out of every merge and
+# approval whitelist.
+description: "AI coding agents -- push branches + open PRs, never merge"
+permission: write
+include_all_repositories: true
+can_create_repos: false
+members:
+  - unkin-agent