FORGEJO_TOKEN secret injected via env var (not inline expression) to avoid CI injection risk; git insteadOf redirect authenticates the git+https:// circuitforge-core VCS URL at install time.