Add repospawner machine user scoped to terraform-git

repospawner opens repo-creation PRs against terraform-git and needs no other
access, so give it its own identity and a per-repo team instead of adding it to
the org-wide agents team.

- add config/git.unkin.net/user/repospawner.yaml (limited visibility, not admin,
  no org/repo creation), mirroring the unkin-agent bot posture
- add config/git.unkin.net/unkin/team/repospawner.yaml granting write on the
  terraform-git repository only (include_all_repositories false)

config/git.unkin.net/unkin/team/repospawner.yaml

@@ -0,0 +1,16 @@
+# Least-privilege access for the repospawner bot: Write on terraform-git only,
+# which is the minimum Gitea permission that allows pushing a branch and opening
+# a pull request. repospawner does its whole job here (repo-creation PRs), so it
+# is kept out of the org-wide "agents" team (include_all_repositories: true).
+#
+# Merge stays reserved for Ben: branch protection on terraform-git's main sets a
+# merge whitelist of the Owners team only. Keep this team out of every merge and
+# approval whitelist.
+description: "repospawner bot -- push branches + open PRs on terraform-git only"
+permission: write
+include_all_repositories: false
+can_create_repos: false
+repositories:
+  - terraform-git
+members:
+  - repospawner