fix(worker): commit as the token's account and check it can push

The worker committed as a hard-coded "gbr-bot", and a token without Write
access only showed up when a build finished and its push failed. On start it
now reads the token's account (GET /user) for the commit author, and
refuses to run if that account can't push to the games repo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/gbrgames/worker_test.go

@@ -0,0 +1,47 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestCheckBotNeedsPushAccess(t *testing.T) {
+	push := false
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Authorization") != "token secret" {
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+		switch r.URL.Path {
+		case "/api/v1/user":
+			w.Write([]byte(`{"login":"git_ai_bot","email":"bot@example.com"}`))
+		case "/api/v1/repos/org/games":
+			if push {
+				w.Write([]byte(`{"permissions":{"push":true}}`))
+			} else {
+				w.Write([]byte(`{"permissions":{"push":false}}`))
+			}
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer srv.Close()
+
+	c := &workerConfig{gitea: srv.URL, repo: "org/games", botToken: "secret"}
+	if err := c.checkBot(); err == nil || !strings.Contains(err.Error(), "git_ai_bot can't push to org/games") {
+		t.Errorf("read-only bot: got %v", err)
+	}
+	push = true
+	if err := c.checkBot(); err != nil {
+		t.Fatal(err)
+	}
+	if c.botLogin != "git_ai_bot" || c.botEmail != "bot@example.com" {
+		t.Errorf("identity = %s <%s>", c.botLogin, c.botEmail)
+	}
+	c.botToken = "wrong"
+	if err := c.checkBot(); err == nil || !strings.Contains(err.Error(), "GITEA_TOKEN") {
+		t.Errorf("bad token: got %v", err)
+	}
+}