resolveRepo follows org.tangled.repo.declaration to the repo DID and its #tangled_knot service, falling back to legacy sh.tangled.repo records. pushToken asks the PDS for a 60-second receivePack token whose audience is the knot's did:web, which describeKnot on knot1.tangled.sh reports.