lift forgejo's issue finding-mode refusal: #2333 removed the credential failure it was reinstated on

[lex00]

What

#2332 reinstated the forgejo Op generator's findingMode: "issue" refusal
because postOrUpdateGithubIssue's POST and PATCH 401'd against a real
Forgejo instance. #2333 (PR #2350) fixed that credential: ghCredentialEnv
now forwards the resolved token as GH_ENTERPRISE_TOKEN beside GH_TOKEN,
which is the variable gh reads for a host in neither the github.com nor the
ghe.com class.

The refusal's premise is therefore gone. Both halves of
postOrUpdateGithubIssue were driven green during #2333 against a live
codeberg.org/forgejo/forgejo:12 instance reporting 12.0.4+gitea-1.22.0,
from a shell whose GH_CONFIG_DIR held no gh auth login:

first run  (expect POST, a new issue): OK -> http://localhost:3000/chantadmin/infra/issues/2
second run (expect PATCH of the same issue): OK -> http://localhost:3000/chantadmin/infra/issues/2

Sticky, not stacking. The paginated read, the .pull_request == null filter
and the marker startswith match were already confirmed correct against the
same image under #2315.

Why it was not done in #2333

#2333 was scoped to the credential. Lifting the refusal is a generator
behavior change with its own surface to settle:

• inverting the refusal test in
  lexicons/forgejo/src/components/generate-op-pipeline.test.ts
  ("issue finding mode is refused by name (forgejo: the issue finding mode is un-refused and unverified on a real instance #2315)")
• the three tests op(forgejo): reinstate the issue finding-mode refusal, settled against a real instance (#2315) #2332 moved from findingMode: "issue" to
  "pull-request" to get them out of the refusal's way, two of which assert
  exact YAML
• deciding what the emitted job's trigger and step env should be for a
  cron-triggered issue Op on Forgejo, which is not the same question the
  pull_request-triggered comment mode answered

None of that is the credential, and folding it into #2333 would have mixed a
shipped-defect fix with a feature lift.

Do

Lift the findingMode: "issue" refusal in
lexicons/forgejo/src/components/generate-op-pipeline.ts, settle the tests
above, and verify the generated workflow end to end the way #2333 did —
against a real instance, from a shell with no stored gh auth login.

#2333 already corrected that file's module doc comment so it no longer states
the removed premise as fact, and recorded that lifting is filed here.

Refs #2315, #2332, #2333, #2350.