ci: give cargo the credential for the private clawhdf5 git dep

First run failed in `cargo test --workspace`: "failed to load source for
dependency clawhdf5", preceded by three "spurious network error: invalid packet
line" retries. Two separate causes, both needed:

- libgit2 cannot fetch from Gitea's smart-HTTP. images/server.Dockerfile already
  sets CARGO_NET_GIT_FETCH_WITH_CLI for exactly this; the test step did not.
- quantumclaw/clawhdf5 is private (401 anonymous), so the CLI fetch needs a
  credential. Supplied via an insteadOf rewrite from a repo secret, so the token
  is masked in logs and never committed.

The server image build does not hit this — it builds only clawmates-server,
which does not pull cm-brain's clawhdf5 path.

Co-Authored-By: Claude Opus 5 <[email protected]>

.gitea/workflows/deploy.yml

@@ -50,6 +50,14 @@ jobs:
       # Rust lives in a container because gw-04 has no cargo. The named volumes
       # are the whole reason this is not painfully slow: without them every run
       # recompiles the world.
+      # `cargo test --workspace` builds cm-brain, which pulls clawhdf5 from
+      # git.redclaw.dev — a PRIVATE repo. Two things are needed and neither is
+      # optional:
+      #   CARGO_NET_GIT_FETCH_WITH_CLI — libgit2 fails against Gitea's smart-HTTP
+      #     with "invalid packet line" (the server Dockerfile sets it for the
+      #     same reason). Note it is _GIT_FETCH_WITH_CLI, not _NET_FETCH_.
+      #   the insteadOf rewrite — supplies the credential to that CLI fetch.
+      # The token is a repo secret, so it is masked in logs and never in git.
       - name: Rust tests
         run: |
           docker run --rm --network host \
@@ -58,9 +66,15 @@ jobs:
             -v cm-ci-cargo-git:/usr/local/cargo/git \
             -v cm-ci-target:/w/target \
             -e SQLX_OFFLINE=true \
+            -e CARGO_NET_GIT_FETCH_WITH_CLI=true \
+            -e FORGE_TOKEN='${{ secrets.FORGE_TOKEN }}' \
             -e CM_TEST_DATABASE_URL=postgres://postgres:[email protected]:55432/postgres \
             rust:1.96-slim \
-            sh -c 'apt-get update -qq && apt-get install -y -qq pkg-config libssl-dev cmake git >/dev/null && cargo test --workspace'
+            sh -c 'set -e
+              apt-get update -qq
+              apt-get install -y -qq pkg-config libssl-dev cmake git >/dev/null
+              git config --global url."https://oauth2:[email protected]/".insteadOf "https://git.redclaw.dev/"
+              cargo test --workspace'
 
       - name: Stop test Postgres
         if: always()
@@ -99,8 +113,14 @@ jobs:
             -v cm-ci-cargo-git:/usr/local/cargo/git \
             -v cm-ci-target:/w/target \
             -e SQLX_OFFLINE=true -e CARGO_NET_GIT_FETCH_WITH_CLI=true \
+            -e FORGE_TOKEN='${{ secrets.FORGE_TOKEN }}' \
             rust:1.96-slim \
-            sh -c 'apt-get update -qq && apt-get install -y -qq pkg-config libssl-dev cmake git >/dev/null && cargo build --release -p clawmates-node && cp target/release/clawmates-node frontend/public/dl/clawmates-node-linux-amd64'
+            sh -c 'set -e
+              apt-get update -qq
+              apt-get install -y -qq pkg-config libssl-dev cmake git >/dev/null
+              git config --global url."https://oauth2:[email protected]/".insteadOf "https://git.redclaw.dev/"
+              cargo build --release -p clawmates-node
+              cp target/release/clawmates-node frontend/public/dl/clawmates-node-linux-amd64'
 
           for svc in server frontend broker; do
             docker build -f "images/$svc.Dockerfile" \