feat: add the kettle CLI, replacing the plugin's Python scripts

The plugin resolved its issue store from `__file__`, which put it inside a
versioned plugin cache: issues written from one project were invisible from the
next, and `origin: local` files — the only copy of that work by definition —
were stranded a version bump at a time. The walk that answers "which directory
is the project" was written three times over, and in a linked worktree the three
disagreed. Both are runtime failures rather than logic ones, so the fix is a
compiled binary: one walk, imported rather than re-derived, and a layering rule
the build graph enforces instead of a grep.

Seven packages, knowledge flowing one way. `project` answers which directory is
the project and depends on nothing. `issue` is the domain — format, taxonomy,
validation, checkboxes, dependency graph, the store, eviction — offline, with no
tracker in it. `wire` holds the protocol shapes. `gitea` is the transport,
`mapping` the bridge, `config` the credentials, `cmd` the command tree. Four
tests hold the boundaries, each failing on a real mistake rather than a naming
convention.

The marker moves to `.kettle/` and the login pin moves out of the harness's
settings file into `.kettle/config.yaml`, which pins a login by NAME; the tokens
live in one file per machine, mode 0600, outside every working tree. That
retires the PreToolUse guard hook entirely — the binary holds its own
credentials, so a command running under a login nobody chose is not expressible
rather than caught.

`kettle init` migrates an older `tmp/issues` or `.tea/issues` store in, as a
move: a store left behind at an old path is one somebody edits by accident
months later.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/internal/cmd/flags.go

@@ -0,0 +1,54 @@
+package cmd
+
+import (
+	"flag"
+	"strings"
+
+	"git.noodles.cam/claude-skills/marketplace/cli/internal/issue"
+	"git.noodles.cam/claude-skills/marketplace/cli/internal/project"
+)
+
+// storeFlag registers the one flag almost every command has.
+//
+// An explicit --out overrides the resolved store and is used exactly as typed:
+// a relative --out stays relative to the working directory, because that is
+// what the operator asked for.
+func storeFlag(fs *flag.FlagSet) *string {
+	return fs.String("out", "", "store root (default: <project>/.kettle/issues)")
+}
+
+// storeRoot resolves the store, or explains which directories were searched.
+//
+// No marker anywhere is an answer, not a fallback: a store placed in a
+// plausible-looking directory is the failure the marker exists to replace.
+func storeRoot(out string) (string, error) {
+	if root := issue.Root(out); root != "" {
+		return root, nil
+	}
+	return "", project.NotFoundError("")
+}
+
+// wasSet reports whether the operator actually typed this flag.
+//
+// Needed wherever the empty string is a legitimate value to reject rather than
+// a synonym for "not given": `--check ""` is an empty selector and an error,
+// while no --check at all means "just list the boxes".
+func wasSet(fs *flag.FlagSet, name string) bool {
+	found := false
+	fs.Visit(func(f *flag.Flag) {
+		if f.Name == name {
+			found = true
+		}
+	})
+	return found
+}
+
+// stringList is a repeatable flag: --label tech/sql --label comp/appclick.
+type stringList []string
+
+func (l *stringList) String() string { return strings.Join(*l, ", ") }
+
+func (l *stringList) Set(v string) error {
+	*l = append(*l, v)
+	return nil
+}