feat: add the kettle CLI, replacing the plugin's Python scripts

The plugin resolved its issue store from `__file__`, which put it inside a
versioned plugin cache: issues written from one project were invisible from the
next, and `origin: local` files — the only copy of that work by definition —
were stranded a version bump at a time. The walk that answers "which directory
is the project" was written three times over, and in a linked worktree the three
disagreed. Both are runtime failures rather than logic ones, so the fix is a
compiled binary: one walk, imported rather than re-derived, and a layering rule
the build graph enforces instead of a grep.

Seven packages, knowledge flowing one way. `project` answers which directory is
the project and depends on nothing. `issue` is the domain — format, taxonomy,
validation, checkboxes, dependency graph, the store, eviction — offline, with no
tracker in it. `wire` holds the protocol shapes. `gitea` is the transport,
`mapping` the bridge, `config` the credentials, `cmd` the command tree. Four
tests hold the boundaries, each failing on a real mistake rather than a naming
convention.

The marker moves to `.kettle/` and the login pin moves out of the harness's
settings file into `.kettle/config.yaml`, which pins a login by NAME; the tokens
live in one file per machine, mode 0600, outside every working tree. That
retires the PreToolUse guard hook entirely — the binary holds its own
credentials, so a command running under a login nobody chose is not expressible
rather than caught.

`kettle init` migrates an older `tmp/issues` or `.tea/issues` store in, as a
move: a store left behind at an old path is one somebody edits by accident
months later.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/internal/wire/layering_test.go

@@ -0,0 +1,61 @@
+package wire
+
+import (
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+// The protocol is shared by two layers that may not import each other, and it
+// can only be shared because it reaches for nothing itself: no domain, no
+// configuration, no path resolution, no third party. One import from any of
+// those would drag every user of this package into that layer — which is the
+// whole reason these shapes were lifted out of the transport rather than left
+// there for the bridge to reimplement.
+//
+// The dependency walk, so a helper pulled in three packages deep is caught as
+// the same violation as one written at the top of a file.
+func TestWireDependsOnNothing(t *testing.T) {
+	out, err := exec.Command("go", "list", "-deps", ".").Output()
+	if err != nil {
+		t.Fatalf("go list: %v", err)
+	}
+	for _, dep := range strings.Fields(string(out)) {
+		if dep == "git.noodles.cam/claude-skills/marketplace/cli/internal/wire" {
+			continue
+		}
+		// A standard-library import path has no dot in its first element,
+		// because it has no domain name in front of it.
+		first, _, _ := strings.Cut(dep, "/")
+		if strings.Contains(first, ".") {
+			t.Errorf("the protocol imports %s — these are shapes and identifiers, and nothing else belongs here", dep)
+		}
+	}
+}
+
+// The other half: net/http and os are standard library, so "no third-party
+// imports" would not catch a transport or a file read written by hand here.
+// Name them.
+//
+// DIRECT imports, not the dependency walk — fmt reaches os on its own, and the
+// question this asks is what THIS package reaches for.
+func TestWireReachesNeitherTheNetworkNorTheDisk(t *testing.T) {
+	forbidden := map[string]string{
+		"net/http": "an HTTP call belongs in the transport",
+		"net":      "an HTTP call belongs in the transport",
+		"os":       "a shape reads no file and no environment",
+		"os/exec":  "nothing here shells out",
+		"io":       "nothing here is a stream",
+		"time":     "a timestamp crosses as the string the tracker sent",
+	}
+
+	out, err := exec.Command("go", "list", "-f", `{{join .Imports "\n"}}`, ".").Output()
+	if err != nil {
+		t.Fatalf("go list: %v", err)
+	}
+	for _, dep := range strings.Fields(string(out)) {
+		if why, bad := forbidden[dep]; bad {
+			t.Errorf("wire imports %s — %s", dep, why)
+		}
+	}
+}