admin-log: add conflict-free clementine/vs-only paths onto main

2026/2026-09-07--git-meta-origin-forgejo.md

@@ -0,0 +1,55 @@
+# `$HOME/git/` meta-repo origin on git.hacktivism.ch (2026-09-07)
+
+## Remote
+
+| Item | Value |
+|------|--------|
+| Host | **Forgejo rootless** `https://git.hacktivism.ch/` |
+| Repo | **hernani/git** (meta-repo: non-secret globals only) |
+| Visibility | **private** (`DEFAULT_PRIVATE` template is public — create with `private:true`) |
+| Default branch | `main` |
+| SSH clone (FQDN form) | `git@git.hacktivism.ch:hernani/git.git` |
+| SSH URL (API form) | `ssh://git@git.hacktivism.ch:9200/hernani/git.git` |
+| Local tree | `$HOME/git/` (`PATH[git-root]`) |
+
+Unauth HTTPS browse of a private repo → **404** (expected).
+
+## Local setup (done 2026-09-07 ~14:21)
+
+```bash
+cd "$HOME/git"
+git remote add origin git@git.hacktivism.ch:hernani/git.git
+git push -u origin main
+```
+
+SSH Host `git.hacktivism.ch`: `HostName 127.0.0.1`, `Port 9200`, `User git`, `ProxyJump hernani@koopa`, `IdentityFile ~/.ssh/id_ed25519`.
+
+## Create via One-Shot-Token (on koopa)
+
+Do **not** use xAI / host-expert-ssh mutate for this. SSH as `hernani` → local HTTP **9024**.
+
+```bash
+# unique token name (default gitea-admin may already exist)
+podman exec koopa-forgejo gitea admin user generate-access-token \
+  --username hernani \
+  --token-name "oneshot-git-meta-$(date +%s)" \
+  --scopes write:repository,write:admin \
+  --raw
+# → TOKEN (never log / never commit)
+
+curl -sS -X POST \
+  -H "Authorization: token ${TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d '{"name":"git","private":true,"auto_init":false,"default_branch":"main"}' \
+  http://127.0.0.1:9024/api/v1/admin/users/hernani/repos
+# expect HTTP 201, full_name=hernani/git
+```
+
+Token delete via API often **403** with those scopes — purge leftover `oneshot-*` in Forgejo UI if needed.
+
+## Related
+
+- This admin-log’s own origin: `2026-07-10--admin-log-origin-forgejo.md` (public)
+- Forgejo install: `2026-07-10--forgejo-rootless.md`
+- Host skill quirk: private repos need explicit `private:true`
+- Meta Must: no secrets / no child worktrees in this Forgejo repo