chore: re-trigger Gitea Actions workflows (core-devops agent)

The queue was retrying the same PR forever when merge returned HTTP 405
("User not allowed to merge PR"). ApiError was caught by main() and returned
0, so the next tick tried the same PR again — infinite loop.

Changes:
- Add MergePermissionError(ApiError) for permanent merge failures
- merge_pull() catches ApiError and re-raises MergePermissionError for
  HTTP 403/404/405
- process_once() catches MergePermissionError, posts a comment on the PR
  explaining the permission issue, and returns 0

The PR stays in the merge-queue label so future ticks can retry after
the permission issue is resolved.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/scripts/gitea-merge-queue.py

@@ -432,10 +432,10 @@ def process_once(*, dry_run: bool = False) -> int:
             post_comment(
                 pr_number,
                 (
-                    f"merge-queue: merge failed with HTTP 405 'User not allowed to merge PR'. "
-                    f"No available token has Can-merge permission on this repo. "
-                    f"Fix: grant Can-merge to a token, or add a maintain/admin collaborator. "
-                    f"Skipping to next queued PR — this PR will be retried on the next queue tick."
+                    "merge-queue: merge failed with HTTP 405 'User not allowed to merge PR'. "
+                    "No available token has Can-merge permission on this repo. "
+                    "Fix: grant Can-merge to a token, or add a maintain/admin collaborator. "
+                    "Skipping to next queued PR on next tick."
                 ),
                 dry_run=dry_run,
             )

.gitea/workflows/sop-checklist.yml

@@ -84,7 +84,6 @@ on:
 permissions:
   contents: read
   pull-requests: read
-  secrets: read
   # NOTE: `statuses: write` is the GitHub-Actions name for POST /statuses.
   # Gitea 1.22.6 may not gate on this permission key (it just checks the
   # token), but listing it explicitly documents intent for the next

.gitea/workflows/sop-tier-check.yml

@@ -71,7 +71,6 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
-      secrets: read
     steps:
       - name: Check out base branch (for the script)
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2