feat: add the kettle CLI, replacing the plugin's Python scripts

The plugin resolved its issue store from `__file__`, which put it inside a
versioned plugin cache: issues written from one project were invisible from the
next, and `origin: local` files — the only copy of that work by definition —
were stranded a version bump at a time. The walk that answers "which directory
is the project" was written three times over, and in a linked worktree the three
disagreed. Both are runtime failures rather than logic ones, so the fix is a
compiled binary: one walk, imported rather than re-derived, and a layering rule
the build graph enforces instead of a grep.

Seven packages, knowledge flowing one way. `project` answers which directory is
the project and depends on nothing. `issue` is the domain — format, taxonomy,
validation, checkboxes, dependency graph, the store, eviction — offline, with no
tracker in it. `wire` holds the protocol shapes. `gitea` is the transport,
`mapping` the bridge, `config` the credentials, `cmd` the command tree. Four
tests hold the boundaries, each failing on a real mistake rather than a naming
convention.

The marker moves to `.kettle/` and the login pin moves out of the harness's
settings file into `.kettle/config.yaml`, which pins a login by NAME; the tokens
live in one file per machine, mode 0600, outside every working tree. That
retires the PreToolUse guard hook entirely — the binary holds its own
credentials, so a command running under a login nobody chose is not expressible
rather than caught.

`kettle init` migrates an older `tmp/issues` or `.tea/issues` store in, as a
move: a store left behind at an old path is one somebody edits by accident
months later.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/internal/mapping/labels.go

@@ -0,0 +1,123 @@
+package mapping
+
+import (
+	"strings"
+
+	"git.noodles.cam/claude-skills/marketplace/cli/internal/issue"
+	"git.noodles.cam/claude-skills/marketplace/cli/internal/wire"
+)
+
+// How the taxonomy is painted in Gitea's UI. A hex code says nothing about what
+// an issue IS, which is exactly why the table lives here and not in the domain
+// — internal/issue/taxonomy.go says as much where the labels themselves are.
+//
+// The keys are the canonical set and nothing else. TestEveryCanonicalLabelHasA
+// Color walks issue.CanonicalLabels() and fails on a gap, so a type or a
+// severity added over there cannot quietly arrive here as grey.
+var labelColors = map[string]string{
+	"type/bug":             "#ee0701",
+	"type/task":            "#0e8a16",
+	"type/refactor":        "#1d76db",
+	"type/test":            "#fbca04",
+	"type/feature":         "#5319e7",
+	"type/draft":           "#cccccc",
+	"severity/low":         "#c2e0c6",
+	"severity/medium":      "#fbca04",
+	"severity/high":        "#eb6420",
+	"severity/showstopper": "#ee0701",
+	"severity/critical":    "#b60205",
+}
+
+// DefaultColor paints everything outside the canonical set. `tech/*` and
+// `comp/*` are project-specific and have no preset, so guessing a color for one
+// would be inventing a meaning it does not have.
+const DefaultColor = "#ededed"
+
+// LabelColor is the hex code a label is painted with in the tracker.
+func LabelColor(name string) string {
+	if c, ok := labelColors[name]; ok {
+		return c
+	}
+	return DefaultColor
+}
+
+// LabelSpecs is the request body for each name, in the order given.
+//
+// A wire.LabelRequest and not a shape of this package's own: it is field for
+// field what a label create takes, and a second spelling of it would mean the
+// bootstrap command copying four fields across on its way to the transport.
+// Exclusivity and meaning come from the domain taxonomy; only the color is
+// decided here.
+//
+// A slice and not a map: the order is the taxonomy's, and a bootstrap prints
+// its plan in that order — a map would shuffle the plan on every run and make
+// two identical runs look like different ones.
+func LabelSpecs(names []string) []wire.LabelRequest {
+	ns := exclusiveNamespaces()
+	out := make([]wire.LabelRequest, 0, len(names))
+	for _, name := range names {
+		out = append(out, wire.LabelRequest{
+			Name:        name,
+			Color:       LabelColor(name),
+			Description: typeMeaning(name),
+			Exclusive:   hasAnyPrefix(name, ns),
+		})
+	}
+	return out
+}
+
+// CanonicalLabelSpecs is the set a repository needs before a push can attach
+// anything.
+//
+// Derived from the domain's own list rather than restated: add a type over in
+// the taxonomy and the next bootstrap creates it, with no line changing here
+// except the color it is painted with.
+func CanonicalLabelSpecs() []wire.LabelRequest { return LabelSpecs(issue.CanonicalLabels()) }
+
+// exclusiveNamespaces are the namespaces at most one label may come from, read
+// off the canonical set rather than listed again — the domain publishes exactly
+// the exclusive namespaces there, in full, and that is what makes the set
+// canonical.
+//
+// A prefix test and not a membership test, on purpose: a project's own
+// `type/spike` is still exclusive. Being one of a set of alternatives is a
+// property of the namespace, not of the members the taxonomy happens to know.
+func exclusiveNamespaces() []string {
+	var out []string
+	seen := map[string]bool{}
+	for _, name := range issue.CanonicalLabels() {
+		ns, _, ok := strings.Cut(name, "/")
+		if !ok || seen[ns] {
+			continue
+		}
+		seen[ns] = true
+		out = append(out, ns+"/")
+	}
+	return out
+}
+
+// typeMeaning is the description a `type/*` label carries into the tracker, so
+// the meaning a reader needs is on the chip rather than in this repository.
+// Nothing else gets one: a severity explains itself, and a project's own
+// namespaces are not ours to describe.
+func typeMeaning(name string) string {
+	tail, ok := strings.CutPrefix(name, "type/")
+	if !ok {
+		return ""
+	}
+	for _, t := range issue.Types {
+		if t.Name == tail {
+			return t.Meaning
+		}
+	}
+	return ""
+}
+
+func hasAnyPrefix(s string, prefixes []string) bool {
+	for _, p := range prefixes {
+		if strings.HasPrefix(s, p) {
+			return true
+		}
+	}
+	return false
+}