runtime: bake tea + gitea-mcp binaries + let GITEA_TOKEN pass through

Prep for the SDLC coding team. Adds two upstream Gitea binaries to
the clawmates-runtime image so team-scoped agents can drive
git.redclaw.dev without custom MCP code:

- tea v0.14.2 (shell CLI: clone/push/pr checkout, git remote helper)
- gitea-mcp v1.3.0 (native MCP server: list_repo_pull_requests,
  create_pull_request, create_file, update_file, create_branch,
  create_issue, get_file_content, etc.)

Both installed by arch (amd64 / arm64) at image build time; also
adds git to the runtime layer since it was missing (needed by tea's
shell delegates).

research_container::inherited_env now propagates GITEA_ prefixed
vars so a team container inherits GITEA_TOKEN (+ optional GITEA_HOST)
from the server env. Team-scoped daemons can then start gitea-mcp
via stdio with --token-env GITEA_TOKEN.

Followup on gw-04:
1. rebuild clawmates-runtime image against the new Dockerfile
2. add [mcp_bundles.gitea_forge] to the runtime template
3. set GITEA_TOKEN in the server compose env

crates/cm-api/src/research_container.rs

@@ -154,6 +154,11 @@ fn inherited_env() -> Vec<String> {
         "GROQ_",
         "ZAI_",
         "KIMI_",
+        // GITEA_TOKEN + GITEA_HOST propagate so gitea-mcp (spawned as
+        // an MCP subprocess by the team's zeroclaw daemon) + the tea
+        // CLI both authenticate against git.redclaw.dev without a
+        // config file bind-mount.
+        "GITEA_",
     ];
     let mut out = Vec::new();
     for (k, v) in std::env::vars() {

deploy/clawmates-runtime/Dockerfile

@@ -24,12 +24,38 @@ FROM debian:bookworm-slim
 # on it too) to install BOTH agent CLIs that the subprocess providers spawn:
 # `claude -p` (claude_cli, Claude subscription) and `kimi -p` (kimi_cli, Kimi
 # membership) — subscription-backed, no per-minute API TPM ceiling.
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl gnupg \
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl gnupg git \
     && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
     && npm install -g @anthropic-ai/claude-code @moonshot-ai/kimi-code \
     && npm cache clean --force \
     && rm -rf /var/lib/apt/lists/* /root/.npm
+
+# Upstream Gitea SDLC tooling for team-scoped agents that operate on
+# git.redclaw.dev. `tea` covers shell-level ops (git remote helpers,
+# clone/push, PR checkout); `gitea-mcp` gives the LLM a structured
+# MCP tool surface (create_pr, list_repo_issues, create_file, etc.).
+# Both are official upstream binaries — no custom bundle to maintain.
+ARG TEA_VERSION=0.14.2
+ARG GITEA_MCP_VERSION=1.3.0
+RUN set -eux; \
+    arch="$(dpkg --print-architecture)"; \
+    case "$arch" in \
+      amd64) mcp_asset="Linux_x86_64" ;; \
+      arm64) mcp_asset="Linux_arm64" ;; \
+      *) echo "unsupported arch: $arch"; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://dl.gitea.com/tea/${TEA_VERSION}/tea-${TEA_VERSION}-linux-${arch}" \
+      -o /usr/local/bin/tea && chmod +x /usr/local/bin/tea; \
+    tmp="$(mktemp -d)" && \
+      curl -fsSL "https://gitea.com/gitea/gitea-mcp/releases/download/v${GITEA_MCP_VERSION}/gitea-mcp_${mcp_asset}.tar.gz" \
+        -o "$tmp/gitea-mcp.tgz" && \
+      tar -xzf "$tmp/gitea-mcp.tgz" -C "$tmp" && \
+      install -m 0755 "$tmp/gitea-mcp" /usr/local/bin/gitea-mcp && \
+      rm -rf "$tmp"; \
+    /usr/local/bin/tea --version | head -1; \
+    /usr/local/bin/gitea-mcp --version 2>&1 | head -1 || true
+
 COPY --from=build /usr/local/bin/zeroclaw /usr/local/bin/zeroclaw
 ENV HOME=/zeroclaw-data \
     ZEROCLAW_WORKSPACE=/zeroclaw-data/workspace \