feat: add the kettle CLI, replacing the plugin's Python scripts

The plugin resolved its issue store from `__file__`, which put it inside a
versioned plugin cache: issues written from one project were invisible from the
next, and `origin: local` files — the only copy of that work by definition —
were stranded a version bump at a time. The walk that answers "which directory
is the project" was written three times over, and in a linked worktree the three
disagreed. Both are runtime failures rather than logic ones, so the fix is a
compiled binary: one walk, imported rather than re-derived, and a layering rule
the build graph enforces instead of a grep.

Seven packages, knowledge flowing one way. `project` answers which directory is
the project and depends on nothing. `issue` is the domain — format, taxonomy,
validation, checkboxes, dependency graph, the store, eviction — offline, with no
tracker in it. `wire` holds the protocol shapes. `gitea` is the transport,
`mapping` the bridge, `config` the credentials, `cmd` the command tree. Four
tests hold the boundaries, each failing on a real mistake rather than a naming
convention.

The marker moves to `.kettle/` and the login pin moves out of the harness's
settings file into `.kettle/config.yaml`, which pins a login by NAME; the tokens
live in one file per machine, mode 0600, outside every working tree. That
retires the PreToolUse guard hook entirely — the binary holds its own
credentials, so a command running under a login nobody chose is not expressible
rather than caught.

`kettle init` migrates an older `tmp/issues` or `.tea/issues` store in, as a
move: a store left behind at an old path is one somebody edits by accident
months later.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/internal/gitea/labels.go

@@ -0,0 +1,108 @@
+package gitea
+
+import (
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"git.noodles.cam/claude-skills/marketplace/cli/internal/wire"
+)
+
+// ListLabels is every label in the repository, every page of it.
+//
+// A bootstrap decides its plan against this and never against a cache: a cache
+// answers "what did we create last time", and the question is "what does the
+// repository have right now".
+func (c *Client) ListLabels() ([]wire.Label, error) {
+	return paginate[wire.Label](c, c.repoPath("labels"), 100)
+}
+
+// CreateLabel adds a label to the repository.
+//
+// Through the API rather than through any CLI wrapper, because `exclusive` —
+// the flag that makes `type/*` behave like a single choice — is not something
+// the `tea` client could set.
+//
+// What a label MEANS is not decided here either: this creates what it is
+// handed.
+func (c *Client) CreateLabel(req wire.LabelRequest) (*wire.Label, error) {
+	var got wire.Label
+	body := &Body{Name: "label-" + req.Name, Data: req}
+	if err := c.Call(http.MethodPost, c.repoPath("labels"), body, &got); err != nil {
+		return nil, err
+	}
+	if got.ID == 0 {
+		return nil, fmt.Errorf("creating label %q: the tracker's answer carries no id", req.Name)
+	}
+	return &got, nil
+}
+
+// EditLabel patches an existing label by id.
+func (c *Client) EditLabel(id int64, req wire.LabelRequest) (*wire.Label, error) {
+	var got wire.Label
+	body := &Body{Name: "label-" + req.Name, Data: req}
+	if err := c.Call(http.MethodPatch, c.repoPathf("labels/%d", id), body, &got); err != nil {
+		return nil, err
+	}
+	return &got, nil
+}
+
+// ListMilestones is every milestone in the repository, open and closed.
+//
+// Both states, always: a milestone is closed the moment its work is done, and a
+// listing that hid those would fail to resolve exactly the filter somebody
+// types when they want to see what was in it.
+func (c *Client) ListMilestones() ([]wire.Milestone, error) {
+	return paginate[wire.Milestone](c, c.repoPath("milestones?state=all"), 100)
+}
+
+// ResolveMilestone finds a milestone by id or by title, and fails when there is
+// none.
+//
+// It fails LOUDLY, and that is the whole point of resolving before filtering:
+// Gitea silently ignores a `milestones=` filter it cannot resolve and answers
+// with the entire backlog. A typo in a milestone name would otherwise read as
+// "your milestone has 300 issues in it".
+func (c *Client) ResolveMilestone(value string) (*wire.Milestone, error) {
+	got, err := c.ListMilestones()
+	if err != nil {
+		return nil, err
+	}
+	for i := range got {
+		if got[i].Title == value || strconv.FormatInt(got[i].ID, 10) == value {
+			return &got[i], nil
+		}
+	}
+	have := make([]string, 0, len(got))
+	for _, m := range got {
+		have = append(have, fmt.Sprintf("%s (id %d)", m.Title, m.ID))
+	}
+	if len(have) == 0 {
+		have = []string{"none"}
+	}
+	return nil, fmt.Errorf("no milestone %q in %s — have: %s", value, c.repo, strings.Join(have, ", "))
+}
+
+// FindMilestone is the milestone with this title, or nil when the repository
+// has no such milestone.
+//
+// The quiet counterpart of ResolveMilestone, for a push: an issue naming a
+// milestone the tracker does not have is filed without one, because refusing
+// the whole push over a field the tracker will happily accept as empty helps
+// nobody. "none" and "" are both "no milestone".
+func (c *Client) FindMilestone(title string) (*wire.Milestone, error) {
+	if title == "" || title == "none" {
+		return nil, nil
+	}
+	got, err := c.ListMilestones()
+	if err != nil {
+		return nil, err
+	}
+	for i := range got {
+		if got[i].Title == title {
+			return &got[i], nil
+		}
+	}
+	return nil, nil
+}