The Gitea CI runners need to authenticate to git.neuralplatform.ai
through Cloudflare Access without going through Google OAuth. Add a
non-identity service token Will can attach to the existing
dashboard-managed Gitea Access application via a Service Auth policy.
The application itself stays dashboard-managed for now to avoid
drifting the human-auth policy that's already working. The token id
goes to Vault at secret/gitea-runner-cf-access where ESO picks it up
into the runner secret.
Will Anderson