M2 GATE: green build via push (Drone + exec runner); OAuth bootstrap script + docs

Build #1 success (clone+hello on exec runner). Drone<->Gitea OAuth scripted as
one-time bootstrap-drone-oauth.sh. M2 claimed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

JOURNAL.md

@@ -245,3 +245,24 @@ cc-ci repo activated in Drone, which requires the bot's Gitea OAuth login (brows
 Drone a Gitea token (to sync repos + set the push webhook). Next tick: script the OAuth login to mint
 a Drone token, activate cc-ci, push .drone.yml, confirm green. (DRONE_USER_CREATE made autonomic-bot
 the admin.)
+
+## 2026-05-26 — M2 GATE MET: green build via push (Drone + exec runner)
+
+**Drone↔Gitea OAuth (scripted, the one manual bootstrap):** logged the bot into Gitea (CSRF cookie
+→ form), drove Drone `/login` → Gitea authorize consent (POST `/login/oauth/grant` with _csrf+state+
+granted=true) → code callback → Drone `_session_`. Captured the whole flow in
+`scripts/bootstrap-drone-oauth.sh` (reads bot creds from env; documented in install.md §2; one-time,
+token persists in Drone's data volume).
+
+**Repo activation:** `GET /api/user` → autonomic-bot admin=true; `GET /api/user/repos?latest=true`
+synced 12 repos; `POST /api/repos/recipe-maintainers/cc-ci` → active=true, config_path .drone.yml
+(sets the Gitea push webhook).
+
+**Green build:** added `.drone.yml` (exec pipeline), pushed (0d89e28). Polled
+`/api/repos/recipe-maintainers/cc-ci/builds` → build #1 pending→running→**success**. Steps:
+clone success exit 0; hello success exit 0 — log shows `whoami=root`, `abra 0.13.0-beta-06a57de`,
+`swarm=active` (ran on the host via the exec runner). **M2 gate met; CLAIMED.**
+
+**Next:** M3 — comment-bridge service: Gitea issue_comment webhook → verify HMAC + `!testme` exact +
+collaborator → resolve PR head repo/SHA → trigger a parameterized Drone build; post a PR comment with
+the run link. Need a Drone API token for the bridge (mint from the bot's Drone account).