feat: drop the kettle plugin; the binary writes its own skills

The plugin and the binary shipped on two release cadences and nothing on an
operator's machine ever checked that the one they installed described the other.
The generated flag block existed precisely so a renamed flag could not ship with
documentation recommending the old one — and then shipped one version behind the
registry it came from, which is the same bug one hop downstream.

So the prose moved into the binary. `internal/scaffold` embeds every document;
`kettle init` and `kettle gen scaffold` write them into a project's own
`.claude/`. The two cannot disagree because there is one artefact.

The namespace survived the move. A project's skills are flat, so the prefix is
spelled into the directory name (`kettle-issue`); a project's *commands* take
their namespace from a subdirectory, so `commands/kettle/init.md` is still
`/kettle:init`. Four of the six command files are thin pointers at a skill, and
that is what kept ~1,600 lines of `/kettle:…` cross-references true without a
rewrite. `init` and `auth` lost `disable-model-invocation: true` — being a
command is that property — and `auth` now restricts `allowed-tools` so a model
cannot reach `kettle auth add` at all.

`gen scaffold` writes files whole rather than splicing a region. The old
refusal protected somebody's hand-written prose around the block; that prose is
embedded now, so there is none to protect, and preserving local edits would
freeze a project's documentation at whatever version first initialized it.
`--check` warns before an upgrade discards one.

The plugin's `agents-sync.sh` — 141 lines of Python behind a filename that said
`.sh` — became `internal/mirror` and `kettle mirror`. Same seven branches, same
refusal to merge two real files that differ, now with a table test per branch
and a check that a repair converges in one pass. `--hook` is the PreToolUse
form and exits 0 on every path including a panic. It is opt-in per project,
which is strictly narrower than the plugin hook that was on for everybody who
installed it.

`kettle init --interactive` walks a person through the login, the token (read
with the echo off, so it lands in no history and no file), the repository, the
`.claude/` tree and the mirror hook. It refuses a stdin that is not a terminal
and names the flags instead: every question it asks has one, and it performs
nothing itself, so an interactive run and a flag run are one code path.

Two rules that used to be prose are now the binary's: init refuses a linked
worktree and names the main checkout, and writing into an existing
`.claude/settings.json` is refused with the snippet printed rather than
reformatting a file the operator commits.

The scaffold version stamp went to its own `.kettle/scaffold.yaml` rather than
into `config.yaml`, because unknown keys there are a hard error and that file
may be committed and read by whatever build each machine has.

golang.org/x/term becomes a direct dependency; it was already in the tree
indirectly, so no module was added.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/internal/cmd/settings.go

@@ -0,0 +1,133 @@
+package cmd
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// mirrorHookCommand is what gets registered on PreToolUse(Bash).
+//
+// The `command -v` guard is not decoration. This line outlives the binary that
+// wrote it: an operator who uninstalls kettle, or moves it off PATH, would
+// otherwise get a "command not found" on every Bash call in this project, from a
+// hook they set up months ago and have long stopped thinking about. The guard
+// makes the failure mode silence.
+const mirrorHookCommand = `command -v kettle >/dev/null && kettle mirror --hook || true`
+
+// mirrorHookSnippet is what an operator is shown when the merge is not this
+// command's to make.
+const mirrorHookSnippet = `{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          { "type": "command", "command": "` + mirrorHookCommand + `" }
+        ]
+      }
+    ]
+  }
+}`
+
+// errSettingsExist means the file is there, does not hold the hook, and merging
+// it is a decision rather than a step.
+var errSettingsExist = errors.New("settings file already exists")
+
+// settingsPath is `<out>/settings.json` — the shared file, not
+// settings.local.json. The convention this registers is a property of a
+// repository rather than of one developer's checkout, so it belongs in the file
+// that is committed.
+func settingsPath(out string) string { return filepath.Join(out, "settings.json") }
+
+// writeMirrorHook registers the PreToolUse hook, and refuses to rewrite a file
+// it did not create.
+//
+// Three outcomes, and the third is the interesting one:
+//
+//   - no file: it is written, hook and all.
+//   - a file already holding a `kettle mirror` hook: nothing happens.
+//   - a file holding something else: REFUSED unless force, and the snippet is
+//     printed for the operator to paste.
+//
+// That refusal is deliberate and is the only reason this file is not a dozen
+// lines shorter. settings.json is a file the operator owns and commits, and Go's
+// encoding/json cannot preserve key order — so any merge reformats the whole
+// document, and an operator who asked for a documentation hook would find an
+// unrelated diff across a file they share with their team. A snippet they paste
+// costs them ten seconds; a reformat costs them a review.
+func writeMirrorHook(out string, force, dryRun bool) (string, error) {
+	path := settingsPath(out)
+	rel := filepath.Join(filepath.Base(out), "settings.json")
+
+	raw, err := os.ReadFile(path)
+	switch {
+	case errors.Is(err, fs.ErrNotExist):
+		if dryRun {
+			return fmt.Sprintf("created %s (PreToolUse: kettle mirror --hook)", rel), nil
+		}
+		if err := writeFile(path, mirrorHookSnippet+"\n"); err != nil {
+			return "", err
+		}
+		return fmt.Sprintf("created %s (PreToolUse: kettle mirror --hook)", rel), nil
+
+	case err != nil:
+		return "", err
+	}
+
+	var settings map[string]any
+	if err := json.Unmarshal(raw, &settings); err != nil {
+		return "", Fail("%s is not readable as JSON (%v) — fix it, or add the hook by hand:\n\n%s", path, err, mirrorHookSnippet)
+	}
+	if strings.Contains(string(raw), "kettle mirror") {
+		return "", nil // already registered; nothing to do and nothing to say
+	}
+	if !force {
+		return "", fmt.Errorf("%w: %s. Add this to it, or re-run with --force-settings to have kettle merge it (which reformats the file):\n\n%s",
+			errSettingsExist, path, mirrorHookSnippet)
+	}
+
+	merged, err := mergeMirrorHook(settings)
+	if err != nil {
+		return "", err
+	}
+	if dryRun {
+		return fmt.Sprintf("merged the hook into %s (reformatting it)", rel), nil
+	}
+	body, err := json.MarshalIndent(merged, "", "  ")
+	if err != nil {
+		return "", err
+	}
+	if err := writeFile(path, string(body)+"\n"); err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("merged the hook into %s (reformatting it)", rel), nil
+}
+
+// mergeMirrorHook appends the hook to whatever PreToolUse already holds,
+// creating the path if it is not there. Nothing existing is removed or
+// reordered — what is lost is key order, which JSON does not carry, and that
+// is the whole reason this is behind a flag.
+func mergeMirrorHook(settings map[string]any) (map[string]any, error) {
+	if settings == nil {
+		settings = map[string]any{}
+	}
+	hooks, _ := settings["hooks"].(map[string]any)
+	if hooks == nil {
+		hooks = map[string]any{}
+	}
+	pre, _ := hooks["PreToolUse"].([]any)
+	pre = append(pre, map[string]any{
+		"matcher": "Bash",
+		"hooks": []any{
+			map[string]any{"type": "command", "command": mirrorHookCommand},
+		},
+	})
+	hooks["PreToolUse"] = pre
+	settings["hooks"] = hooks
+	return settings, nil
+}