fix(ci): strip JSON5 comments from manifest.json before clone-manifest.sh

Integration Tester appends a trailing `// Triggered by ...` comment to
manifest.json on each run. This is valid JSON5 but breaks `jq` which
clone-manifest.sh uses to parse the file — causing
publish-workspace-server-image and harness-replays to fail on every run.

Fix: pipe manifest.json through `sed '/^[[:space:]]*\/\//d'` before
passing to clone-manifest.sh, producing a clean JSON file for jq.

harness-replays.yml: also downgrade the missing-token check from
`exit 1` to a warning, consistent with publish-workspace-server-image.yml.
All repos are public per the manifest.json OSS surface contract — token
is only needed for private repos.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/harness-replays.yml

@@ -220,12 +220,14 @@ jobs:
         run: |
           set -euo pipefail
           if [ -z "${MOLECULE_GITEA_TOKEN}" ]; then
-            echo "::error::AUTO_SYNC_TOKEN secret is empty — register the devops-engineer persona PAT in repo Actions secrets"
-            exit 1
+            echo "::warning::AUTO_SYNC_TOKEN not set — using anonymous clone (repos are public per manifest.json OSS contract)"
           fi
           mkdir -p .tenant-bundle-deps
+          # Strip JSON5 comments before jq parsing — Integration Tester appends
+          # `// Triggered by ...` which breaks `jq` in clone-manifest.sh.
+          sed '/^[[:space:]]*\/\//d' manifest.json > .manifest-stripped.json
           bash scripts/clone-manifest.sh \
-            manifest.json \
+            .manifest-stripped.json \
             .tenant-bundle-deps/workspace-configs-templates \
             .tenant-bundle-deps/org-templates \
             .tenant-bundle-deps/plugins

.gitea/workflows/publish-workspace-server-image.yml

@@ -96,8 +96,11 @@ jobs:
           # 2026-05-08 migration). The token is only needed for private repos.
           # Do NOT require it — a missing secret would fail the build unnecessarily.
           mkdir -p .tenant-bundle-deps
+          # Strip JSON5 comments before jq parsing — Integration Tester appends
+          # `// Triggered by ...` which breaks `jq` in clone-manifest.sh.
+          sed '/^[[:space:]]*\/\//d' manifest.json > .manifest-stripped.json
           bash scripts/clone-manifest.sh \
-            manifest.json \
+            .manifest-stripped.json \
             .tenant-bundle-deps/workspace-configs-templates \
             .tenant-bundle-deps/org-templates \
             .tenant-bundle-deps/plugins