fix(P03 W6/W7): forge-agnostic token name in run_platform.sh + config (REQ-230)

The W6 'unset NOVA_GITEA_TOKEN' line in scripts/run_platform.sh tripped
the test_no_forge_mentions guard (REQ-230 forbids forge-specific names in
synced files). Renamed to NOVA_FORGE_TOKEN (forge-agnostic); .env.secrets
adds NOVA_FORGE_TOKEN as an alias; config.json scopes now map forge + gitea
-> NOVA_FORGE_TOKEN. scripts/rotate_spike_key.sh (excluded from the sync
scan) keeps the NOVA_GITEA_TOKEN backward-compat fallback for local runs.
Full suite green (844 passed).

---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W6
---

.ciagent/config.json

@@ -72,7 +72,8 @@
     "sources": [".env", ".env.secrets", ".env.*"],
     "disallow": ["shell_env", "netrc", "keychain", "rc_files", "global_config"],
     "scopes": {
-      "gitea": "NOVA_GITEA_TOKEN",
+      "forge": "NOVA_FORGE_TOKEN",
+      "gitea": "NOVA_FORGE_TOKEN",
       "github": "GITHUB_TOKEN",
       "gitlab": "GITLAB_TOKEN",
       "openai": "OPENAI_API_KEY",

scripts/run_platform.sh

@@ -389,11 +389,14 @@ if [ -z "${AWS_ACCESS_KEY_ID:-}" ] || [ -z "${AWS_SECRET_ACCESS_KEY:-}" ]; then
   # the shell env (SPEC §5.2 — the platform consumes NOVA_AWS_* as workflow
   # secrets, not shell env; config.security.bash_allowlist.blocked_env_vars
   # blocks NOVA_AWS_* from shell env — the v1.8 root-cause guard).
+  # The forge-token name is forge-agnostic (NOVA_FORGE_TOKEN, REQ-230);
+  # scripts/rotate_spike_key.sh (excluded from the sync scan) keeps a
+  # forge-specific backward-compat fallback for local runs.
   export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID"
   export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY"
   # Region: prefer the .env.secrets AWS_DEFAULT_REGION; default us-east-1.
   export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"
-  unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_GITEA_TOKEN
+  unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_FORGE_TOKEN
 fi
 
 echo "=== Step 3c: Checkov on static code (fail-fast, before terraform plan) ==="

tests/test_deploy_workflow_env_input.py

@@ -113,5 +113,5 @@ def test_run_platform_sh_local_fallback_unsets_raw_nova_aws_vars():
     assert 'export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID"' in text
     assert 'export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY"' in text
     assert 'export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"' in text
-    # ...then unsets the raw NOVA_AWS_* + the forge-token name.
-    assert "unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_GITEA_TOKEN" in text
+    # ...then unsets the raw NOVA_AWS_* + the forge-agnostic forge-token name.
+    assert "unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_FORGE_TOKEN" in text