Prepare release engine

bin/token.sh

@@ -0,0 +1,17 @@
+# Loads the Gitea token into GITEA_TOKEN: the environment first, then .gitea-token in the repository (gitignored),
+# then ~/.config/wp-lit-mcp/gitea-token. Sourced by bin/ship.sh and bin/release-publish.sh, which define $root and fail().
+
+load_token() {
+    local file
+    for file in "$root/.gitea-token" "$HOME/.config/wp-lit-mcp/gitea-token"; do
+        [[ -z "${GITEA_TOKEN:-}" && -r "$file" ]] || continue
+        # A token file the repository would commit, or that others can read, is refused before it is used.
+        if [[ "$file" == "$root/.gitea-token" ]]; then
+            git -C "$root" check-ignore -q .gitea-token || fail ".gitea-token steht nicht in .gitignore"
+        fi
+        [[ "$(stat -c %a "$file")" =~ ^[0-7]00$ ]] || fail "$file ist für andere lesbar: chmod 600"
+        GITEA_TOKEN="$(<"$file")"
+    done
+    [[ -n "${GITEA_TOKEN:-}" ]] \
+        || fail "Kein Token: GITEA_TOKEN setzen oder .gitea-token im Repo (alternativ ~/.config/wp-lit-mcp/gitea-token) anlegen"
+}