ops(forgejo): whitelist owner in branch protection push rule

Earlier config was enable_push=false + apply_to_admins=false, which I
expected to let the repo owner push directly. Empirically it blocked
owner pushes too — apply_to_admins governs approval-rule bypass, not
push-rule bypass. Switch to enable_push=true with enable_push_whitelist
and a single entry so the owner has explicit, auditable direct-push
access while casual commits still can't land without being whitelisted
or going through a PR.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ops/forgejo/branch-protection.json

@@ -1,5 +1,7 @@
 {
-  "enable_push": false,
+  "enable_push": true,
+  "enable_push_whitelist": true,
+  "push_whitelist_usernames": ["daniel"],
   "enable_status_check": true,
   "status_check_contexts": [
     "CI / lint*",