fix: feat: dev-agent merges its own PRs via non-admin Codeberg account (#172)

- phase-handler.sh: remove do_merge(); on APPROVAL inject exact API
  commands for agent to merge+close directly; PHASE:done now only
  does local cleanup (tmux, worktree, labels) — merge already done
- dev-agent.sh: update PHASE_PROTOCOL_INSTRUCTIONS — Approved means
  merge via API, close issue, then write PHASE:done
- dev-poll.sh: remove try_merge_or_rebase(); for approved+CI-green
  orphaned PRs, spawn dev-agent (recovery mode) to merge instead
- .env.example: document new token roles (CODEBERG_TOKEN = bot for
  push/PR/merge; REVIEW_BOT_TOKEN = human account for approvals)
- AGENTS.md: update token descriptions to match new roles

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dev/dev-agent.sh

@@ -523,10 +523,27 @@ echo \"PHASE:awaiting_ci\" > \"${PHASE_FILE}\"
 (CI runs again after each push — always write awaiting_ci, not awaiting_review)
 
 **When you receive an \"Approved\" injection:**
+The injection includes exact API commands. Merge the PR and close the issue directly:
 \`\`\`bash
+# Merge (replace NNN with the actual PR number from the injection):
+curl -sf -X POST \\
+  -H \"Authorization: token \${CODEBERG_TOKEN}\" \\
+  -H 'Content-Type: application/json' \\
+  \"${API}/pulls/NNN/merge\" \\
+  -d '{\"Do\":\"merge\",\"delete_branch_after_merge\":true}'
+
+# Close the issue:
+curl -sf -X PATCH \\
+  -H \"Authorization: token \${CODEBERG_TOKEN}\" \\
+  -H 'Content-Type: application/json' \\
+  \"${API}/issues/${ISSUE}\" \\
+  -d '{\"state\":\"closed\"}'
+
+# Signal done:
 echo \"PHASE:done\" > \"${PHASE_FILE}\"
 \`\`\`
-The orchestrator handles the merge. You are done.
+If merge fails due to conflicts, rebase first then retry the merge.
+If merge repeatedly fails, write PHASE:needs_human.
 
 **If refusing (too large, unmet dep, already done):**
 \`\`\`bash