fix: bug: hire-an-agent does not add the new agent as collaborator on the project repo (#856)

hire-an-agent now adds the new Forgejo user as a `write` collaborator on
`$FORGE_REPO` right after the token step, mirroring the collaborator setup
lib/forge-setup.sh applies to the canonical bot users. Without this, a
freshly hired agent's PATCH to assign itself an issue returned 403 Forbidden
and the dev-agent polled forever logging "claim lost to <none>".

issue_claim() now captures the PATCH HTTP status via `-w '%{http_code}'`
instead of swallowing failures with `curl -sf ... || return 1`. A 403 (or
any non-2xx) now surfaces a distinct log line naming the code — the missing
collaborator root cause would have been diagnosable in seconds instead of
minutes.

Also updates the lib-issue-claim bats mock to handle the new `-w` flag and
adds a regression test covering the HTTP-error log surfacing path.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/lib-issue-claim.bats

@@ -52,12 +52,13 @@ setup() {
   # canned responses per endpoint. Every call gets logged as
   # `METHOD URL` (one line) to $CALLS_LOG for later grep-based asserts.
   curl() {
-    local method="GET" url="" arg
+    local method="GET" url="" arg want_code=""
     while [ $# -gt 0 ]; do
       arg="$1"
       case "$arg" in
         -X) method="$2"; shift 2 ;;
         -H|-d|--data-binary|-o) shift 2 ;;
+        -w) want_code="$2"; shift 2 ;;
         -sf|-s|-f|--silent|--fail) shift ;;
         *) url="$arg"; shift ;;
       esac
@@ -89,7 +90,13 @@ setup() {
         fi
         ;;
       "PATCH ${FORGE_API}/issues/"*)
-        : # accept any PATCH; body is ignored by the mock
+        # Accept any PATCH; body ignored. When caller asked for the HTTP
+        # status via `-w '%{http_code}'` (issue_claim does this since #856
+        # to surface 403s from missing collaborator permission), emit the
+        # code configured by the scenario (default 200).
+        if [ "$want_code" = '%{http_code}' ]; then
+          printf '%s' "${MOCK_PATCH_CODE:-200}"
+        fi
         ;;
       "GET ${FORGE_API}/labels")
         printf '[]'
@@ -165,6 +172,28 @@ count_calls() {
   [ "$(count_calls GET "${FORGE_API}/labels")" -eq 0 ]
 }
 
+# ── PATCH HTTP error surfacing (#856) ───────────────────────────────────────
+
+@test "issue_claim logs specific HTTP code on PATCH failure (403 = missing collaborator)" {
+  export MOCK_ME="bot"
+  export MOCK_INITIAL_ASSIGNEE=""
+  export MOCK_RECHECK_ASSIGNEE=""
+  export MOCK_PATCH_CODE="403"
+
+  run issue_claim 42
+  [ "$status" -eq 1 ]
+
+  # The new log message names the HTTP code explicitly — without this,
+  # a missing-collaborator setup (#856) falls through to the post-PATCH
+  # verify and masquerades as "claim lost to <none>".
+  [[ "$output" == *"PATCH assignee failed: HTTP 403"* ]]
+
+  # No re-read on PATCH failure (we bail before reaching the verify step).
+  [ "$(count_calls GET "${FORGE_API}/issues/42")" -eq 1 ]
+  [ "$(count_calls PATCH "${FORGE_API}/issues/42")" -eq 1 ]
+  [ "$(count_calls POST "${FORGE_API}/issues/42/labels")" -eq 0 ]
+}
+
 # ── pre-check skip ──────────────────────────────────────────────────────────
 
 @test "issue_claim skips early (no PATCH) when pre-check shows another assignee" {