A GITEA_TOKEN secret stored with a trailing newline makes curl emit
`Authorization: token <value>\n`. The bare LF terminates the header
block early, so Content-Type and everything after it is parsed as
request body and Gitea rejects the call with 422 "Empty Content-Type".
GETs were unaffected because nothing they need follows the auth header,
which is why this presented as a proxy stripping the header.
- trim CR/LF and surrounding whitespace off GITHUB_TOKEN, GITEA_TOKEN,
GITEA_URL and GITEA_OWNER, warning when a value needed it
- rebuild redact() on bash substitution; the previous sed s/// blew up
with "unterminated `s' command" on a token containing a newline
- add AGENTS.md / CLAUDE.md documenting the run flow and these traps
