fix: keep request payloads out of the issue store

`labels.py` handed `_gitea.api` the issue store as a place to put the
request file, and on a checkout without a store that quietly created
`tmp/issues/.payload/`. Bootstrapping a repository's labels touches no
issue at all, so the one rule the store has — nothing materializes it as
a side effect of a write — was broken by an operation that has no
business knowing the store exists.

Where a request body goes was never the caller's decision to make. It is
now the transport's: `tmp/payload/`, resolved from `_gitea.py`'s own
location the way both domains resolve theirs, so every caller — sync and
wiki alike — writes to one directory whatever it was invoked from, and
`out_root` is gone from `api`, `add_dependency` and all six call sites.
The directory is created by the first write of a run and not before: a
`--dry-run` leaves nothing behind. `tmp/` is already gitignored.

The name carries the distinction the old path lost. A store holds the
only copy of something; this holds debris kept for a retry or a
post-mortem, and deleting it costs nothing. A dotdir sitting among an
issue's files claimed otherwise, and `ls tmp/issues` started lying about
what existed.

tests/test_payload_root.py runs the real `labels.py` in a throwaway repo
against a fake `tea` on PATH: no store appears, the payloads land in
tmp/payload/, a dry run writes nothing, and a run from a subdirectory
still resolves to the repo root. Two source checks keep the callers from
drifting apart again.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

skills/sync/scripts/comment.py

@@ -73,13 +73,11 @@ def main():
 
     if args.edit:
         got = _gitea.api(login, "%s/issues/comments/%d" % (base, args.edit), "PATCH",
-                         {"body": body}, payload_name="comment-%d" % args.edit,
-                         out_root=root)
+                         {"body": body}, payload_name="comment-%d" % args.edit)
         verb = "edited"
     else:
         got = _gitea.api(login, "%s/issues/%d/comments" % (base, number), "POST",
-                         {"body": body}, payload_name="comment-%s" % args.id,
-                         out_root=root)
+                         {"body": body}, payload_name="comment-%s" % args.id)
         verb = "posted"
     if not isinstance(got, dict) or "id" not in got:
         _gitea.die("%s failed, unexpected response" % verb)