feat: add the kettle CLI, replacing the plugin's Python scripts

The plugin resolved its issue store from `__file__`, which put it inside a
versioned plugin cache: issues written from one project were invisible from the
next, and `origin: local` files — the only copy of that work by definition —
were stranded a version bump at a time. The walk that answers "which directory
is the project" was written three times over, and in a linked worktree the three
disagreed. Both are runtime failures rather than logic ones, so the fix is a
compiled binary: one walk, imported rather than re-derived, and a layering rule
the build graph enforces instead of a grep.

Seven packages, knowledge flowing one way. `project` answers which directory is
the project and depends on nothing. `issue` is the domain — format, taxonomy,
validation, checkboxes, dependency graph, the store, eviction — offline, with no
tracker in it. `wire` holds the protocol shapes. `gitea` is the transport,
`mapping` the bridge, `config` the credentials, `cmd` the command tree. Four
tests hold the boundaries, each failing on a real mistake rather than a naming
convention.

The marker moves to `.kettle/` and the login pin moves out of the harness's
settings file into `.kettle/config.yaml`, which pins a login by NAME; the tokens
live in one file per machine, mode 0600, outside every working tree. That
retires the PreToolUse guard hook entirely — the binary holds its own
credentials, so a command running under a login nobody chose is not expressible
rather than caught.

`kettle init` migrates an older `tmp/issues` or `.tea/issues` store in, as a
move: a store left behind at an old path is one somebody edits by accident
months later.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/internal/wire/key.go

@@ -0,0 +1,103 @@
+package wire
+
+import (
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+// Repo is one repository, spelled the way a tracker spells it.
+type Repo struct {
+	Owner string
+	Name  string
+}
+
+func (r Repo) String() string {
+	if r.Zero() {
+		return ""
+	}
+	return r.Owner + "/" + r.Name
+}
+
+// Zero reports whether this names no repository. Both halves are required:
+// half a name addresses nothing.
+func (r Repo) Zero() bool { return r.Owner == "" || r.Name == "" }
+
+// ParseRepo reads owner/name.
+func ParseRepo(s string) (Repo, error) {
+	owner, name, ok := strings.Cut(strings.TrimSpace(s), "/")
+	if !ok || owner == "" || name == "" {
+		return Repo{}, fmt.Errorf("repo %q is not owner/name", s)
+	}
+	return Repo{Owner: owner, Name: name}, nil
+}
+
+// Key is a stable cross-repo handle for one issue: owner/repo#42.
+//
+// It is what the ledger is keyed by and what the `gitea:` metadata field holds,
+// so it has to survive being written to a file and read back — which is why it
+// is a repository and a number and not a bare number. A number is ambiguous the
+// moment a dependency lives in another repository, and dependencies are allowed
+// to.
+type Key struct {
+	// Repo is zero when the caller named a number and nothing else, which is
+	// the common case on a command line: "42" means "42 in this project's
+	// repository", and which repository that is, is the client's business.
+	Repo   Repo
+	Number int
+}
+
+func (k Key) String() string {
+	if k.Repo.Zero() {
+		return "#" + strconv.Itoa(k.Number)
+	}
+	return fmt.Sprintf("%s#%d", k.Repo, k.Number)
+}
+
+// In returns this key with r filled in when it names no repository of its own.
+func (k Key) In(r Repo) Key {
+	if k.Repo.Zero() {
+		k.Repo = r
+	}
+	return k
+}
+
+// The four spellings, as patterns.
+//
+// Digits and only digits after the `#`, which is the test strconv.Atoi is too
+// generous to make on its own: it accepts a sign, and `owner/repo#-3` is not a
+// handle anybody ever wrote. Anything that is not a key has to be recognizable
+// as not a key — a hand-edited metadata line and a number are told apart here
+// and nowhere else.
+var (
+	keyURL       = regexp.MustCompile(`^https?://[^/]+/([^/]+)/([^/]+)/issues/(\d+)/?$`)
+	keyQualified = regexp.MustCompile(`^([\w.-]+/[\w.-]+)#(\d+)$`)
+	keyNumber    = regexp.MustCompile(`^#?(\d+)$`)
+)
+
+// ParseKey reads an issue key: 42, #42, owner/repo#42, or the issue's URL.
+//
+// All four spellings because all four are what somebody has in hand — a number
+// from a receipt, a `#42` copied out of a body, a qualified key out of the
+// ledger, a URL pasted from a browser. Refusing three of them buys nothing.
+func ParseKey(s string) (Key, error) {
+	s = strings.TrimSpace(s)
+	if m := keyURL.FindStringSubmatch(s); m != nil {
+		n, _ := strconv.Atoi(m[3])
+		return Key{Repo: Repo{Owner: m[1], Name: m[2]}, Number: n}, nil
+	}
+	if m := keyQualified.FindStringSubmatch(s); m != nil {
+		repo, err := ParseRepo(m[1])
+		if err != nil {
+			return Key{}, err
+		}
+		n, _ := strconv.Atoi(m[2])
+		return Key{Repo: repo, Number: n}, nil
+	}
+	if m := keyNumber.FindStringSubmatch(s); m != nil {
+		n, _ := strconv.Atoi(m[1])
+		return Key{Number: n}, nil
+	}
+	return Key{}, fmt.Errorf("cannot parse issue key %q — want 42, #42, owner/repo#42, or an issue URL", s)
+}