feat: add the kettle CLI, replacing the plugin's Python scripts

The plugin resolved its issue store from `__file__`, which put it inside a
versioned plugin cache: issues written from one project were invisible from the
next, and `origin: local` files — the only copy of that work by definition —
were stranded a version bump at a time. The walk that answers "which directory
is the project" was written three times over, and in a linked worktree the three
disagreed. Both are runtime failures rather than logic ones, so the fix is a
compiled binary: one walk, imported rather than re-derived, and a layering rule
the build graph enforces instead of a grep.

Seven packages, knowledge flowing one way. `project` answers which directory is
the project and depends on nothing. `issue` is the domain — format, taxonomy,
validation, checkboxes, dependency graph, the store, eviction — offline, with no
tracker in it. `wire` holds the protocol shapes. `gitea` is the transport,
`mapping` the bridge, `config` the credentials, `cmd` the command tree. Four
tests hold the boundaries, each failing on a real mistake rather than a naming
convention.

The marker moves to `.kettle/` and the login pin moves out of the harness's
settings file into `.kettle/config.yaml`, which pins a login by NAME; the tokens
live in one file per machine, mode 0600, outside every working tree. That
retires the PreToolUse guard hook entirely — the binary holds its own
credentials, so a command running under a login nobody chose is not expressible
rather than caught.

`kettle init` migrates an older `tmp/issues` or `.tea/issues` store in, as a
move: a store left behind at an old path is one somebody edits by accident
months later.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/internal/gitea/remotemap_test.go

@@ -0,0 +1,80 @@
+package gitea_test
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.noodles.cam/claude-skills/marketplace/cli/internal/gitea"
+	"git.noodles.cam/claude-skills/marketplace/cli/internal/wire"
+)
+
+func TestRemoteMapRoundTrips(t *testing.T) {
+	root := filepath.Join(t.TempDir(), "issues")
+	key := wire.Key{Repo: wire.Repo{Owner: "acme", Name: "widgets"}, Number: 42}
+
+	m := gitea.RemoteMap{}
+	m.Set(key, "wire-sqlc-appclick")
+	if err := m.Save(root); err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+
+	path := gitea.RemoteMapPath(root)
+	if want := filepath.Join(root, ".remote.json"); path != want {
+		t.Errorf("the ledger is at %s, want %s — beside the issues it indexes", path, want)
+	}
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("reading the ledger: %v", err)
+	}
+	if !strings.Contains(string(raw), `"acme/widgets#42": "wire-sqlc-appclick"`) {
+		t.Errorf("the ledger is not readable by a human:\n%s", raw)
+	}
+
+	back := gitea.LoadRemoteMap(root)
+	if got := back.Slug(key); got != "wire-sqlc-appclick" {
+		t.Errorf("the key came back as %q, want wire-sqlc-appclick", got)
+	}
+	if got := back.Slug(wire.Key{Repo: key.Repo, Number: 7}); got != "" {
+		t.Errorf("an unrecorded key answered %q", got)
+	}
+
+	// A rebuild is a merge and never a replacement: what is already recorded
+	// survives an entry added on top of it. This is what makes a pull of a
+	// number whose file was deleted by a push land on the same slug.
+	second := wire.Key{Repo: key.Repo, Number: 43}
+	back.Set(second, "drop-the-wiki")
+	if err := back.Save(root); err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+	again := gitea.LoadRemoteMap(root)
+	if again.Slug(key) != "wire-sqlc-appclick" || again.Slug(second) != "drop-the-wiki" {
+		t.Errorf("a second save lost an entry: %v", again)
+	}
+}
+
+// The ledger is a cache of markers the tracker holds, so an unreadable one must
+// not stop the pull that would rebuild it.
+func TestRemoteMapSurvivesAMissingOrMangledFile(t *testing.T) {
+	root := t.TempDir()
+
+	if got := gitea.LoadRemoteMap(filepath.Join(root, "nowhere")); len(got) != 0 {
+		t.Errorf("a missing ledger loaded as %v", got)
+	}
+	if err := os.WriteFile(gitea.RemoteMapPath(root), []byte("{ not json at all"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	got := gitea.LoadRemoteMap(root)
+	if len(got) != 0 {
+		t.Errorf("a mangled ledger loaded as %v", got)
+	}
+	// Still writable afterwards: an unreadable ledger costs a re-pull, not a run.
+	got.Set(wire.Key{Repo: wire.Repo{Owner: "acme", Name: "widgets"}, Number: 1}, "first")
+	if err := got.Save(root); err != nil {
+		t.Fatalf("Save over a mangled ledger: %v", err)
+	}
+	if gitea.LoadRemoteMap(root).Slug(wire.Key{Repo: wire.Repo{Owner: "acme", Name: "widgets"}, Number: 1}) != "first" {
+		t.Error("the ledger did not come back after being rewritten")
+	}
+}