feat: add the kettle CLI, replacing the plugin's Python scripts

The plugin resolved its issue store from `__file__`, which put it inside a
versioned plugin cache: issues written from one project were invisible from the
next, and `origin: local` files — the only copy of that work by definition —
were stranded a version bump at a time. The walk that answers "which directory
is the project" was written three times over, and in a linked worktree the three
disagreed. Both are runtime failures rather than logic ones, so the fix is a
compiled binary: one walk, imported rather than re-derived, and a layering rule
the build graph enforces instead of a grep.

Seven packages, knowledge flowing one way. `project` answers which directory is
the project and depends on nothing. `issue` is the domain — format, taxonomy,
validation, checkboxes, dependency graph, the store, eviction — offline, with no
tracker in it. `wire` holds the protocol shapes. `gitea` is the transport,
`mapping` the bridge, `config` the credentials, `cmd` the command tree. Four
tests hold the boundaries, each failing on a real mistake rather than a naming
convention.

The marker moves to `.kettle/` and the login pin moves out of the harness's
settings file into `.kettle/config.yaml`, which pins a login by NAME; the tokens
live in one file per machine, mode 0600, outside every working tree. That
retires the PreToolUse guard hook entirely — the binary holds its own
credentials, so a command running under a login nobody chose is not expressible
rather than caught.

`kettle init` migrates an older `tmp/issues` or `.tea/issues` store in, as a
move: a store left behind at an old path is one somebody edits by accident
months later.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/internal/wire/request.go

@@ -0,0 +1,59 @@
+package wire
+
+// The bodies that go up, and the shorthand that fills them.
+//
+// The omitted keys carry meaning of their own on a PATCH: a key that is absent
+// leaves the tracker's value alone, and a key that is present overwrites it. So
+// "no opinion" and "empty" must not marshal the same way, which is what every
+// pointer and every omitempty below is for.
+
+// IssueRequest is the body of a create or an edit.
+//
+// Every field is a pointer because Gitea reads an absent key as "no opinion"
+// and a present one as "make it this", and the difference is not academic: an
+// empty `ref` CLEARS the branch an issue is pinned to, and an empty `labels`
+// clears its labels. A caller meaning to change only the state would do both by
+// accident with plain zero values. Set fills a field; leaving it nil leaves the
+// tracker's copy alone.
+type IssueRequest struct {
+	Title *string `json:"title,omitempty"`
+	Body  *string `json:"body,omitempty"`
+	// Labels is a pointer because `[]` is a statement — it clears every label
+	// on the issue — while a caller that has not resolved label ids at all has
+	// no business making it. A plain slice with omitempty cannot say both.
+	Labels    *[]int64  `json:"labels,omitempty"`
+	Assignees *[]string `json:"assignees,omitempty"`
+	// Milestone is a pointer for the same reason, and because 0 is Gitea's
+	// "detach from its milestone" — a value somebody may well mean.
+	Milestone *int64  `json:"milestone,omitempty"`
+	State     *string `json:"state,omitempty"`
+	Ref       *string `json:"ref,omitempty"`
+}
+
+// LabelRequest is the body of a label create or edit — everything a repository
+// needs to make one label.
+//
+// Value fields, not pointers, and every one of them is sent: Gitea 1.26 patches
+// only what it is given, but an older server reads an absent field as empty and
+// blanks it. A label edit is rare enough that sending the unchanged name and
+// description along costs nothing and removes a way to lose them.
+//
+// It goes up as a request body of its own because `tea labels create` could not
+// set `exclusive` — the flag that makes `type/*` behave like a single choice —
+// which is the whole reason label creation went through the API rather than a
+// CLI wrapper.
+//
+// What a label MEANS — which namespaces are exclusive, what colour a severity
+// is — is not decided here. This is the shape; the taxonomy is the domain's and
+// the palette is the bridge's.
+type LabelRequest struct {
+	Name        string `json:"name"`
+	Color       string `json:"color"`
+	Description string `json:"description"`
+	Exclusive   bool   `json:"exclusive"`
+}
+
+// Set is a pointer to v, for filling the optional fields of a request. Gitea
+// reads an absent key as "no opinion" and a present one as "make it this", so
+// those fields are pointers and this is the shorthand that fills them.
+func Set[T any](v T) *T { return &v }