Centralize encrypted bot profiles (#14)

Centralize ordered bot profiles and encrypted credentials in `bot-agents`.

- Exposes one action input: `master-key`.
- Uses Gitea’s automatic job token internally; dependent repositories provide no author/reviewer/profile inputs.
- Keeps encrypted Claude and reviewer credentials in `profiles.yml`; tokenless Codex uses its persisted subscription login.
- Falls back only on recognized quota exhaustion, with a distinct UID/home per profile and descendant cleanup before fallback.
- Separates decryption, agent execution, and reviewer posting so privileged credentials never enter an agent process.
- Installs `obra/superpowers` with the standard Skills CLI; removes custom discovery code.
- Adds root-level isolation, rollback, symlink, fallback, posting, YAML, and self-workflow CI coverage.

Checks: formatting, lint, all entrypoint type checks, 35 tests as root, diff check, secret scan, and repository diagnostics.
Reviewed-on: #14
Co-authored-by: Danny Kim <temeddix@gmail.com>
Co-committed-by: Danny Kim <temeddix@gmail.com>

prompt.md

@@ -19,10 +19,8 @@ author's push credentials. Read the code there, run its checks and tests when
 they bear on the task, and push from there.
 
 For a `pull_request` event, and for a comment on a pull request that asks you to
-review it, use the installed `superpowers:requesting-code-review` skill before
-inspecting the PR. Its exact installed instructions and reviewer template are
-included below, so this run fails before reaching you if they could not be
-loaded. You are the reviewer that has already been dispatched, so run the
+review it, use the installed `requesting-code-review` skill before inspecting
+the PR. You are the reviewer that has already been dispatched, so run the
 skill's code reviewer template yourself instead of dispatching another reviewer.
 Use the pull request and triggering instruction as its description and
 requirements, and review the exact base and head SHAs without changing code. Run
@@ -47,14 +45,6 @@ addressed to the author; the author's own agent picks the fixes up, so never ask
 and pixel-perfect, and that included screenshots prove the intended result was
 achieved.
 
-# Installed Superpowers review skill
-
-${SUPERPOWERS_REVIEW_SKILL}
-
-# Installed Superpowers reviewer template
-
-${SUPERPOWERS_REVIEW_TEMPLATE}
-
 Every finding that belongs to one line of the diff goes on that line instead of
 into the body. Write those to `${ANCHORS_PATH}` as a JSON array, each entry
 `{"path": "<path from the repository root>", "line": <number>, "side": "new" |