fix(P03 W6/W7): forge-agnostic token name in run_platform.sh + config (REQ-230)

The W6 'unset NOVA_GITEA_TOKEN' line in scripts/run_platform.sh tripped
the test_no_forge_mentions guard (REQ-230 forbids forge-specific names in
synced files). Renamed to NOVA_FORGE_TOKEN (forge-agnostic); .env.secrets
adds NOVA_FORGE_TOKEN as an alias; config.json scopes now map forge + gitea
-> NOVA_FORGE_TOKEN. scripts/rotate_spike_key.sh (excluded from the sync
scan) keeps the NOVA_GITEA_TOKEN backward-compat fallback for local runs.
Full suite green (844 passed).

---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W6
---

.ciagent/config.json

@@ -72,7 +72,8 @@
     "sources": [".env", ".env.secrets", ".env.*"],
     "disallow": ["shell_env", "netrc", "keychain", "rc_files", "global_config"],
     "scopes": {
-      "gitea": "NOVA_GITEA_TOKEN",
+      "forge": "NOVA_FORGE_TOKEN",
+      "gitea": "NOVA_FORGE_TOKEN",
       "github": "GITHUB_TOKEN",
       "gitlab": "GITLAB_TOKEN",
       "openai": "OPENAI_API_KEY",