CI-12 round 2: INFRA_READ_TOKEN for admin/goodwe; the pin tracks release/1.0

- checks.yml's infra checkout and infra-pin.yml's admin/goodwe ls-remote use
  the INFRA_READ_TOKEN secret; the self fetch keeps GITHUB_TOKEN.
- infra-pin.yml compares against admin/goodwe refs/heads/release/1.0; STALE
  message, comments and README follow.
- test_control.py / test_alloc.py: drop the claim that CI cannot reach
  admin/goodwe.
- .gitea/infra-pin is DELIBERATELY one release/1.0 merge behind (d84ac01) for
  the "infra-pin / fresh goes red" proof; the next commit sets it to HEAD.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/checks.yml

@@ -494,7 +494,8 @@ jobs:
       - name: check out admin/goodwe at the pin in .gitea/infra-pin
         env:
           URL: ${{ github.server_url }}/admin/goodwe.git
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Read access to admin/goodwe only; this job's own token cannot see it.
+          TOKEN: ${{ secrets.INFRA_READ_TOKEN }}
         run: |
           set -eu
           PIN=$(grep -v '^#' "$WS/goodwe-addon/.gitea/infra-pin" | tr -d '[:space:]')

.gitea/workflows/infra-pin.yml

@@ -1,5 +1,6 @@
-# CI-12: goes red when admin/goodwe master has moved past .gitea/infra-pin, so
-# the pin cannot go stale silently. Deliberately NOT a required check: it
+# CI-12: goes red when admin/goodwe release/1.0 has moved past .gitea/infra-pin.
+# It runs on add-on activity only; admin/goodwe's own `addon-pin` workflow
+# covers a move of release/1.0 there. Deliberately NOT a required check: it
 # reports; `checks / unit` stays the only gate. How to bump: README.md,
 # "CI and the infra pin".
 name: infra-pin
@@ -14,25 +15,26 @@ jobs:
     runs-on: [self-hosted, goodwe-rig]
     timeout-minutes: 30   # seconds of work; the rest is queueing for the shared slot
     steps:
-      - name: compare .gitea/infra-pin with admin/goodwe master
+      - name: compare .gitea/infra-pin with admin/goodwe release/1.0
         env:
           SELF: ${{ github.server_url }}/${{ github.repository }}.git
           INFRA: ${{ github.server_url }}/admin/goodwe.git
           TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          INFRA_TOKEN: ${{ secrets.INFRA_READ_TOKEN }}   # admin/goodwe is private
         run: |
           set -eu
-          auth() { echo "$1" | sed "s#://#://x-access-token:${TOKEN}@#"; }
+          auth() { echo "$1" | sed "s#://#://x-access-token:${2:-$TOKEN}@#"; }
           D=$(mktemp -d) && cd "$D"
           git init -q . && git remote add origin "$(auth "$SELF")"
           # The pin of the commit this event is about (the PR head, or the push).
           git fetch -q --depth 1 origin "$GITHUB_SHA"
           PIN=$(git show FETCH_HEAD:.gitea/infra-pin | grep -v '^#' | tr -d '[:space:]')
-          HEAD=$(git ls-remote "$(auth "$INFRA")" refs/heads/master | cut -f1)
+          HEAD=$(git ls-remote "$(auth "$INFRA" "$INFRA_TOKEN")" refs/heads/release/1.0 | cut -f1)
           cd / && rm -rf "$D"
-          test -n "$HEAD" || { echo "FAIL: could not read admin/goodwe master."; exit 1; }
+          test -n "$HEAD" || { echo "FAIL: could not read admin/goodwe release/1.0."; exit 1; }
           if [ "$PIN" != "$HEAD" ]; then
-            echo "STALE: .gitea/infra-pin is $PIN but admin/goodwe master is $HEAD."
+            echo "STALE: .gitea/infra-pin is $PIN but admin/goodwe release/1.0 is $HEAD."
             echo "       Test against $HEAD and bump the pin (README.md, \"CI and the infra pin\")."
             exit 1
           fi
-          echo "OK: .gitea/infra-pin $PIN is admin/goodwe master HEAD."
+          echo "OK: .gitea/infra-pin $PIN is admin/goodwe release/1.0 HEAD."