fix(#1323): remove legacy credential read and force-merge recipe from mosaic-gitea

Same defect class as the #1320 Should Fix, at the two spots the #1320 file
list missed (found by rev-security-01's review of #1322, filed as #1323):

- Setup section framed a shared-credential env read
  (~/.config/mosaic/credentials/gitea.env — no longer part of the credential
  system) as the way to enable force-merges. The credentials loader is now
  the only documented source, and the force-merge framing is gone.
- 'Force-merge bypassing branch protection' section carried the full raw
  curl + force_merge:true recipe. Replaced with the same wrapper-only
  guidance merged in #1322: protection blocks are signals to fix, never to
  bypass; exceptional cases go to the operator or coordinating seat, still
  through the wrapper.

Scan before fixing (whole shipped framework tree, three patterns — gitea.env
/ credentials/*.env reads, force_merge, raw merge curl): the two handed spots
in mosaic-gitea were the complete set; no seventh carrier. Post-fix rescan:
zero recipe matches; the only force_merge strings left are the guidance text
that forbids it. Closes #1323.

packages/mosaic/framework/skills/mosaic-gitea/SKILL.md

@@ -11,13 +11,8 @@ Git operations via Mosaic wrapper scripts. Platform-aware (Gitea or GitHub).
 
 Scripts auto-detect platform from git remote. Run from inside the repo directory.
 
-For force-merge (branch protection bypass):
-
-```bash
-GITEA_TOKEN=$(cat ~/.config/mosaic/credentials/gitea.env | grep TOKEN | cut -d= -f2)
-```
-
-Or use the credentials loader:
+Credentials come from the framework credentials loader (never from a shared env
+file):
 
 ```bash
 source ~/.config/mosaic/tools/_lib/credentials.sh
@@ -86,14 +81,10 @@ cd ~/src/<repo>
 ~/.config/mosaic/tools/git/pr-merge.sh -n <pr#> -d
 ```
 
-**Force-merge bypassing branch protection:**
-
-```bash
-GITEA_TOKEN=$(cat ~/.config/mosaic/credentials/gitea.env | grep TOKEN | cut -d= -f2)
-curl -X POST "https://git.mosaicstack.dev/api/v1/repos/<org>/<repo>/pulls/<PR>/merge" \
-  -H "Authorization: token $GITEA_TOKEN" -H "Content-Type: application/json" \
-  -d '{"Do":"squash","force_merge":true}'
-```
+Branch protection is a gate, not an obstacle: if it blocks a merge, fix the cause —
+a failing check, a moved head, or a missing review. Never bypass it with a raw
+API call, a shared credential, or `force_merge`. Exceptional cases go to the
+operator or the coordinating seat, still merged through the wrapper.
 
 ## Notes