feat: add the kettle CLI, replacing the plugin's Python scripts

The plugin resolved its issue store from `__file__`, which put it inside a
versioned plugin cache: issues written from one project were invisible from the
next, and `origin: local` files — the only copy of that work by definition —
were stranded a version bump at a time. The walk that answers "which directory
is the project" was written three times over, and in a linked worktree the three
disagreed. Both are runtime failures rather than logic ones, so the fix is a
compiled binary: one walk, imported rather than re-derived, and a layering rule
the build graph enforces instead of a grep.

Seven packages, knowledge flowing one way. `project` answers which directory is
the project and depends on nothing. `issue` is the domain — format, taxonomy,
validation, checkboxes, dependency graph, the store, eviction — offline, with no
tracker in it. `wire` holds the protocol shapes. `gitea` is the transport,
`mapping` the bridge, `config` the credentials, `cmd` the command tree. Four
tests hold the boundaries, each failing on a real mistake rather than a naming
convention.

The marker moves to `.kettle/` and the login pin moves out of the harness's
settings file into `.kettle/config.yaml`, which pins a login by NAME; the tokens
live in one file per machine, mode 0600, outside every working tree. That
retires the PreToolUse guard hook entirely — the binary holds its own
credentials, so a command running under a login nobody chose is not expressible
rather than caught.

`kettle init` migrates an older `tmp/issues` or `.tea/issues` store in, as a
move: a store left behind at an old path is one somebody edits by accident
months later.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/internal/cmd/new.go

@@ -0,0 +1,144 @@
+package cmd
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"git.noodles.cam/claude-skills/marketplace/cli/internal/issue"
+)
+
+func init() {
+	register(&Command{
+		Name:  "new",
+		Group: GroupIssue,
+		Short: "create a local issue from its type template",
+		Long: `The issue is real the moment this writes the file. Nothing is pending, nothing
+is a draft awaiting a tracker: ` + "`origin: local`" + ` is a complete state and pushing it
+later is optional.
+
+While it says local, this file is the ONLY copy of the work — the store, not a
+cache of anything. That is what a push changes: it hands the issue to the
+tracker and removes the file.
+
+Writes .tea/issues/<slug>.md prefilled with the type's template, prints the
+path, and rebuilds INDEX.md. Fill the sections in an editor, then run
+` + "`kettle check <id>`" + `.
+
+Body prose is Russian, section headers and the title are English.`,
+		Examples: []Example{
+			{`kettle new --type task --title "Wire sqlc into the appclick repo layer" --label tech/sql --label comp/appclick`,
+				"a task with two free-form labels"},
+			{`kettle new --type bug --title "Fix tea-guard crash on empty settings" --depends wire-sqlc-appclick --milestone v0.2`,
+				"a bug that is blocked by another issue"},
+		},
+		Setup: func(fs *flag.FlagSet) func([]string) error {
+			typ := fs.String("type", "", "issue type, one of: "+strings.Join(issue.TypeNames(), ", ")+" (becomes the exclusive type/* label)")
+			title := fs.String("title", "", "English, imperative, no type prefix")
+			id := fs.String("id", "", "slug (default: derived from the title)")
+			severity := fs.String("severity", "", "severity/* label, one of: "+strings.Join(issue.Severities, ", "))
+			milestone := fs.String("milestone", "", "milestone title")
+			var labels, assignees, depends stringList
+			fs.Var(&labels, "label", "extra label, e.g. tech/sql; repeat")
+			fs.Var(&assignees, "assignee", "assignee login; repeat")
+			fs.Var(&depends, "depends", "id this issue depends on; repeat")
+			out := storeFlag(fs)
+
+			return func(args []string) error {
+				if *typ == "" || *title == "" {
+					return Fail("--type and --title are both required")
+				}
+				if !issue.KnownType(*typ) {
+					return Fail("unknown --type %q — known: %s", *typ, strings.Join(issue.TypeNames(), ", "))
+				}
+				if *severity != "" && !issue.KnownSeverity(*severity) {
+					return Fail("unknown --severity %q — known: %s", *severity, strings.Join(issue.Severities, ", "))
+				}
+				// Before anything reads the store path. There is no store to be
+				// second-guessed about when there is no project.
+				root, err := storeRoot(*out)
+				if err != nil {
+					return err
+				}
+
+				labelSet := []string{"type/" + *typ}
+				if *severity != "" {
+					labelSet = append(labelSet, "severity/"+*severity)
+				}
+				for _, l := range labels {
+					if !contains(labelSet, l) {
+						labelSet = append(labelSet, l)
+					}
+				}
+
+				slug := *id
+				if slug == "" {
+					if slug, err = issue.UniqueID(root, issue.Slugify(*title, 0), nil); err != nil {
+						return err
+					}
+				} else if !issue.IsSlug(slug) {
+					return Fail("--id %q is not a slug (lowercase, digits, single dashes)", slug)
+				}
+				if _, err := os.Stat(issue.PathOf(root, slug)); err == nil {
+					return Fail("%s already exists", issue.PathOf(root, slug))
+				}
+
+				known := map[string]bool{}
+				for _, k := range issue.AllIDs(root) {
+					known[k] = true
+				}
+				for _, d := range depends {
+					if !known[d] {
+						fmt.Fprintf(os.Stderr, "warning: depends on %q, which is not in the store yet\n", d)
+					}
+				}
+
+				i := &issue.Issue{
+					ID:        slug,
+					Title:     *title,
+					Body:      issue.Template(*typ, depends),
+					State:     "open",
+					Labels:    labelSet,
+					Assignees: assignees,
+					Milestone: *milestone,
+					Depends:   depends,
+					Origin:    issue.Local,
+				}
+
+				// The first issue in a fresh checkout has to create the store,
+				// but it says so — and it says where, because the path is
+				// absolute.
+				created, err := issue.CreateStore(root)
+				if err != nil {
+					return err
+				}
+				if created {
+					abs, _ := filepath.Abs(root)
+					fmt.Fprintf(os.Stderr, "created store %s\n", abs)
+				}
+
+				path, err := issue.Save(root, i)
+				if err != nil {
+					return err
+				}
+				if _, _, err := issue.BuildIndex(root); err != nil {
+					return err
+				}
+				fmt.Printf("%s  [type/%s] %s\n", path, *typ, *title)
+				fmt.Printf("fill the sections, then: kettle check %s\n", slug)
+				return nil
+			}
+		},
+	})
+}
+
+func contains(xs []string, x string) bool {
+	for _, v := range xs {
+		if v == x {
+			return true
+		}
+	}
+	return false
+}