pi-dispatch v4.3.1

A patch release. Everything in it was found by running 4.3.0's parked jobs against a real Forgejo 14 server.

Fixes

• Quick answers to a parked run (every forge). If you answered within ten minutes of the label or comment that started the run, the answer was treated as a duplicate and nothing ran. A run that stops to ask now gives up that window, so you can answer right away.
• Forgejo: tea works in jobs. tea logs in only from GITEA_INSTANCE_URL + GITEA_TOKEN, which jobs did not set. Every tea call in a Forgejo job failed: no pull request, no comment, no question.
• Forgejo: the repository owner can start jobs. Forgejo reports the owner's permission as owner, which the author gate did not accept.
• Forgejo: the bot no longer needs admin rights. Forgejo answers "what permission does this user have" only to repository admins, and the branch-protection rule list is admin-only too. The protection check now reads the default branch's own protected flag. For the author check there is a new optional variable, FORGEJO_PERMISSION_TOKEN; see the upgrade steps.
• Forgejo: one pi-awaiting-input label. Forgejo accepts a duplicate label name, so 4.3.0 created a new repository label on every park and left one on the issue. The label is now looked up first and set and cleared by id.
• Forgejo: clearing a label the repository never had is no longer logged as parked_label_failed.
• Panel: a parked run's row says awaiting-input instead of done.

Docs

• The README's run detail, allocation and commands images are now rendered from the fixture deployment, like the dashboard image.
• Azure DevOps: the parked tag calls are tested against recorded Azure responses only, not a live organisation. If the tag does not appear or does not clear, please open an issue with the parked_label_failed line.

Upgrade

1. Pull the job image ghcr.io/edgehero/pi-job:4.3.1, then upgrade the workers, then the receiver (@edgehero/pi-dispatch-receiver@4.3.1 needs worker ^4.3.1).
2. Forgejo only:
   • Give the bot account (FORGEJO_TOKEN) write access to the repository. It no longer needs admin.
   • Let a repository admin, for example the owner, create a token with only read:repository. Set it as FORGEJO_PERMISSION_TOKEN in the receiver's environment. It is never passed to jobs, and the worker refuses it in PI_FORWARD_ENV and run.secrets.
   • Without it, the receiver falls back to FORGEJO_TOKEN, which then must belong to a repository admin; pi-dispatch doctor warns about this.
   • Delete the duplicate pi-awaiting-input repository labels 4.3.0 made (Issues → Labels). Keep the one with the lowest id. Issues still carrying the label clear on their next run.

Full changes: #637, #638, #639, #651.