fix(git-wrappers): no --login must use the caller's own credential, not a guessed shared login (#1352)

packages/mosaic/framework/tools/git/issue-comment.sh

@@ -102,9 +102,17 @@ gitea_resolve_api_for_login() {
             return 1
         }
     else
-        GITEA_API_TOKEN=$(get_gitea_token_for_login "$effective_login" "$host") \
-            || GITEA_API_TOKEN=$(get_gitea_token "$host") || {
-            echo "Error: Gitea token not found for login '$effective_login' (comment write/read-back)" >&2
+        # NO --login: the acting credential is this identity's own token and there
+        # is deliberately no tea-config fallback. get_gitea_token_for_login matches
+        # by login NAME and performs no authentication check, and with no --login
+        # that name was a HOST GUESS resolving to a shared account. A live shared
+        # token would therefore have authored every seat's comment as that
+        # account, making Gate-16 author-is-not-reviewer unenforceable fleet-wide;
+        # a dead one is only what made the defect visible. get_gitea_token fails
+        # loud on a fleet host when no identity resolves, and that refusal is the
+        # correct outcome, not a case to fall back from.
+        GITEA_API_TOKEN=$(get_gitea_token "$host") || {
+            echo "Error: no Gitea credential resolved for the acting identity on host '$host' (comment write/read-back). Set MOSAIC_GIT_IDENTITY=<agent-id>, or pass --login <name> to use a named tea credential." >&2
             return 1
         }
     fi
@@ -335,15 +343,12 @@ if [[ "$PLATFORM" == "github" ]]; then
     gh issue comment "$ISSUE_NUMBER" --body "$COMMENT"
     echo "Added comment to GitHub issue #$ISSUE_NUMBER"
 elif [[ "$PLATFORM" == "gitea" ]]; then
-    # Resolve the login this comment should be attributed to: the --login
-    # override when given, otherwise the detected default for this repo's host.
-    # A --login override always wins. Otherwise name this repo host's login only
-    # as a best effort: the login name merely selects a per-login token, and
-    # gitea_resolve_api_for_login falls back to the host credential
-    # (get_gitea_token) when no tea login is named, so the default credential
-    # still resolves even when the host tea has no matching login entry.
+    # A --login override selects a NAMED tea credential and is the only way to
+    # reach the tea store. With no --login there is deliberately no guess: the
+    # comment is attributed to this identity's own credential, resolved by
+    # gitea_resolve_api_for_login. The guess this replaced named a SHARED
+    # account, selecting an identity the caller never asked to act as.
     EFFECTIVE_LOGIN="$LOGIN_OVERRIDE"
-    [[ -n "$EFFECTIVE_LOGIN" ]] || EFFECTIVE_LOGIN=$(get_gitea_login 2>/dev/null || true)
 
     # Bind the REST endpoint + token to the effective login, then derive the
     # acting identity from that SAME credential (GET /user). The write below and