No token needed: every yukart repo is public; document the caller's runs-on

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DDwfd6Ki8UfG4hK6W5YpJz

.gitea/workflows/crosscheck.yml

@@ -21,8 +21,8 @@ jobs:
     steps:
       - name: Clone every yukart repo
         env:
-          # YUKART_READ_TOKEN (org secret, read-only) reaches the private repos; without it
-          # only the public ones are checked, and the run says so.
+          # Every yukart repo is public, so no token is needed. Should one become private,
+          # an org secret YUKART_READ_TOKEN (read-only) lets this clone it again.
           TOKEN: ${{ secrets.YUKART_READ_TOKEN }}
           SERVER: ${{ gitea.server_url }}
         run: |
@@ -32,7 +32,6 @@ jobs:
           auth=(); [ -n "$TOKEN" ] && auth=(-H "Authorization: token $TOKEN")
           repos=$(curl -fsS "${auth[@]}" "$SERVER/api/v1/orgs/yukart/repos?limit=50" \
                   | python3 -c 'import json,sys; print(" ".join(r["name"] for r in json.load(sys.stdin) if not r["archived"]))')
-          [ -n "$TOKEN" ] || echo "::warning::no YUKART_READ_TOKEN: private repos are not checked"
           for r in $repos; do
             url="$scheme://${TOKEN:+crosscheck:$TOKEN@}$host/yukart/$r.git"
             git clone -q --depth 1 "$url" "ws/$r"