fix(forge): facts.sh must set REPO, and the fragment must fit the bound

Two failures on !193's first run, both real and both caught by the guards
that exist for them.

release-exercise: `lib/forge-forgejo.sh: line 550: REPO: unbound variable`.
The forgejo backend addresses the repository through REPO, which each
reconciler sets for itself; the github backend reads GITHUB_REPOSITORY
directly. facts.sh set neither, so every forgejo read refused — correctly,
and with the new #191 diagnostic, which is how it was legible at all. The
github-path suites could not have caught this: they never touch that
backend.

self-guards: changelog-armed measured a 404-character entry against the
300-character bound (#167). Split into three shorter entries in the same
fragment, which is what the rule asks for.

Refs #191

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

changelog.d/191.md

@@ -2,19 +2,23 @@
 
 - The release doors run on a Forgejo consumer. `lib/facts.sh` and
   `release.yml` gathered and published through `gh`, which the runner image
-  does not ship, so the merge door read `labeled=no` for a correctly labeled
+  does not ship, so the merge door read `labeled=no` for a correctly
-  ceremony PR and the tag door died at the publish (#191).
+  labeled ceremony PR and the tag door died at the publish (#191).
 
 - A release fact that could not be read is no longer reported as a definite
   `no`. A completed read finding no label is still `no` and still
-  fail-closed; a read that did not complete refuses and emits no fact — the
+  fail-closed; a read that did not complete refuses and emits no fact
-  distinction that demoted a ceremony PR to "a bare push" (#191).
+  (#191).
 
 ### Added
 
 - `forge_release_exists`, `forge_commit_pulls`, `forge_tag_create`,
   `forge_release_create` and `forge_pr_create` on both backends, so the
-  release path names no client. Forgejo serves one PR object at
+  release path names no client (#191).
-  `/commits/{sha}/pull` where GitHub serves an array at `/pulls`, and
+
-  creates tags at `/tags` where GitHub POSTs to `/git/refs`; both verbs emit
+- The forgejo backend serves one PR object at `/commits/{sha}/pull` where
-  the GitHub shape so the call sites carry one expression (#191).
+  GitHub serves an array at `/pulls`; both verbs emit the array shape, so
+  the call site carries one expression (#191).
+
+- Forgejo creates tags at `POST /tags` — it serves `/git/refs` GET-only,
+  so GitHub's ref-POST would have 404'd there forever (#191).

lib/facts.sh

@@ -101,6 +101,13 @@ if ! version_is_dev "$ver"; then
   # The forge is selected only in the states that consult the API — a -dev
   # tree, every ordinary merge, still decides on the two versions alone and
   # touches no forge at all (#8's tolerance for empty facts).
+  # The forgejo backend addresses the repo through REPO; the github backend
+  # reads GITHUB_REPOSITORY directly. Set it here from the one this script
+  # already documents, so the two backends address the same repository —
+  # missing it made every forgejo read refuse with "REPO: unbound variable"
+  # (caught by release-exercise on !193).
+  REPO="${REPO:-${GITHUB_REPOSITORY:?facts: GITHUB_REPOSITORY is required for the API facts}}"
+  export REPO
   # "" means decide from the environment; forge_select takes an explicit
   # forge only in tests.
   forge_select "" || exit 1