Forgejo with REQUIRE_SIGN_IN blocks anonymous git clones (exit code 128).
Add WOODPECKER_ENVIRONMENT to inject FORGE_TOKEN into all pipeline steps,
and override the default clone step in ci.yml to use an authenticated URL
built from FORGE_TOKEN — bypassing the expired stored OAuth token.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>