feat: add tokenless Tobserver change skill

tobserver-change/tests/tobserver-agent-test

@@ -0,0 +1,143 @@
+#!/usr/bin/env bash
+
+set -uo pipefail
+
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)
+SKILL_DIR=$(cd "$SCRIPT_DIR/.." && pwd -P)
+HELPER="$SKILL_DIR/scripts/tobserver-agent"
+
+# shellcheck disable=SC1090,SC1091 # The absolute helper path is resolved at runtime.
+source "$HELPER"
+
+passes=0
+failures=0
+
+pass() {
+  printf 'ok - %s\n' "$1"
+  passes=$((passes + 1))
+}
+
+fail() {
+  printf 'not ok - %s\n' "$1" >&2
+  failures=$((failures + 1))
+}
+
+expect_equal() {
+  local name=$1
+  local expected=$2
+  local actual=$3
+
+  if [[ "$actual" == "$expected" ]]; then
+    pass "$name"
+  else
+    printf 'expected: %q\nactual:   %q\n' "$expected" "$actual" >&2
+    fail "$name"
+  fi
+}
+
+expect_success() {
+  local name=$1
+  shift
+  if ("$@" >/dev/null 2>&1); then
+    pass "$name"
+  else
+    fail "$name"
+  fi
+}
+
+expect_failure() {
+  local name=$1
+  shift
+  if ("$@" >/dev/null 2>&1); then
+    fail "$name"
+  else
+    pass "$name"
+  fi
+}
+
+valid_pr_json() {
+  cat <<'JSON'
+{
+  "number": 17,
+  "state": "open",
+  "merged": false,
+  "user": {"login": "oibot"},
+  "base": {"ref": "main"},
+  "head": {
+    "repo": {"full_name": "oibot/Tobserver"},
+    "ref": "refs/pull/17/head",
+    "label": "oibot/tobserver-agent-enable-gc-20260724-120000-abcdef",
+    "sha": "0123456789abcdef"
+  },
+  "flow": 1,
+  "html_url": "https://codeberg.org/oibot/Tobserver/pulls/17"
+}
+JSON
+}
+
+expect_equal \
+  "branch derives helper AGit topic" \
+  "tobserver-agent-enable-gc-20260724-120000-abcdef" \
+  "$(topic_for_branch 'agent/enable-gc-20260724-120000-abcdef')"
+
+expect_equal \
+  "AGit topic derives local branch" \
+  "agent/enable-gc-20260724-120000-abcdef" \
+  "$(branch_for_topic 'tobserver-agent-enable-gc-20260724-120000-abcdef')"
+
+expect_failure "main is not a helper branch" topic_for_branch "main"
+expect_failure "nested branch suffix is rejected" topic_for_branch "agent/nested/change"
+expect_failure "foreign AGit topic is rejected" branch_for_topic "manual-change"
+
+encoded=$(encode_push_option_string $'line one\nGrüße')
+decoded=$(printf '%s' "${encoded#\{base64\}}" | base64 --decode)
+expect_equal "push-option base64 round trip" $'line one\nGrüße' "$decoded"
+
+expect_success \
+  "canonical open AGit PR is revisable" \
+  assert_revisable_pull_request "$(valid_pr_json)" 17 \
+  "tobserver-agent-enable-gc-20260724-120000-abcdef"
+
+wrong_user=$(valid_pr_json | jq '.user.login = "oibot-agent"')
+expect_failure \
+  "bot-authored PR is rejected after cutover" \
+  assert_revisable_pull_request "$wrong_user" 17
+
+non_agit=$(valid_pr_json | jq '.flow = 0')
+expect_failure \
+  "non-AGit PR is rejected" \
+  assert_revisable_pull_request "$non_agit" 17
+
+wrong_head=$(valid_pr_json | jq '.head.ref = "agent/unsafe"')
+expect_failure \
+  "unexpected PR head ref is rejected" \
+  assert_revisable_pull_request "$wrong_head" 17
+
+expect_equal \
+  "canonical PR URL yields number" \
+  "17" \
+  "$(pr_number_from_url 'https://codeberg.org/oibot/Tobserver/pulls/17')"
+expect_failure \
+  "foreign PR URL is rejected" \
+  pr_number_from_url "https://example.invalid/oibot/Tobserver/pulls/17"
+
+if rg -n 'Authorization: token|KEYCHAIN_|read_codeberg_token|codeberg-tobserver-agent' "$HELPER" >/dev/null; then
+  fail "helper contains no bot or write-token path"
+else
+  pass "helper contains no bot or write-token path"
+fi
+
+if bash -n "$HELPER"; then
+  pass "helper parses as Bash"
+else
+  fail "helper parses as Bash"
+fi
+
+if "$HELPER" --help | grep -q 'Codeberg API token'; then
+  pass "help documents tokenless boundary"
+else
+  fail "help documents tokenless boundary"
+fi
+
+printf '\n%d passed; %d failed\n' "$passes" "$failures"
+((failures == 0))