refactor!: rewire the plugin onto the kettle binary, and rename it

BREAKING: the plugin is `kettle`, not `tea`, and its commands are `/kettle:*`.
It also now needs a binary on PATH that it did not need before; the README and
every skill say how to get one and what a missing one looks like.

The plugin was 3800 lines of Python doing what a compiled binary does better,
and the name pointed at a tool that no longer takes part: `tea` is Gitea's CLI,
and since the transport moved into the binary nothing here shells out to it for
issues at all. A plugin named after it was going to keep suggesting otherwise.

Deleted: 19 scripts, the 14-file unittest suite, and the tea-guard hook. The
guard blocked any `tea` invocation that would run under a login the model picked
instead of the operator; the binary holds its own credentials and reads the
pinned login out of the project's own config, so that failure is no longer
expressible and there is nothing left to police. agents-sync stays — it is about
AGENTS.md symlinks and has nothing to do with any of this.

What the plugin keeps is what only a plugin can carry: the rules an operator
states and a binary cannot enforce. `init` still refuses to run inside a linked
worktree and still may not be model-invoked, because which directory is the
project is a statement a person makes. The issue format reference stays here and
stays the source of truth. The runner subagent is still for batches and still
may not decide what an issue says.

The command reference in the issue, sync and project skills is GENERATED from
the binary's own command registry, between markers, so a flag that changed
cannot ship with a skill that recommends the old one. `kettle gen skills
--check` exits non-zero when they drift. The generator owns the region and
nothing outside it: the frontmatter description, which is what decides whether a
skill loads at all, stays hand-written.

`use` survives and is the one place `tea` is still named — for releases,
webhooks and actions, which kettle does not cover. Its instruction to write
`--login "$GITEA_LOGIN"` and let the hook substitute the pin was true until this
commit and is now rewritten: `tea` keeps its own configuration, kettle keeps
its own, and configuring one configures nothing in the other.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

plugins/kettle/skills/use/references/tea/entities.md

@@ -0,0 +1,137 @@
+# tea CLI — ENTITIES
+
+See [`./index.md`](./index.md) for global options and common flags shared by all commands.
+
+## `tea issues` (aliases: `issue`, `i`)
+Without args lists issues; with `<index>` shows issue detail.
+
+Shared filters: `--state {all|open|closed}` (default: open), `--kind {issues|pulls|all}`, `--keyword/-k`, `--labels/-L`, `--milestones/-m`, `--author/-A`, `--assignee/-a`, `--mentions/-M`, `--owner/--org`, `--from/-F`, `--until/-u`, `--comments`. Available fields: `index,state,kind,author,author-id,url,title,body,created,updated,deadline,assignees,milestone,labels,comments,owner,repo`.
+
+Subcommands:
+- `list, ls` — list (same filters as above).
+- `create, c` — create an issue. Options: `--title/-t`, `--description/-d`, `--assignees/-a`, `--labels/-L`, `--milestone/-m`, `--deadline/-D`, `--referenced-version/-v` (commit hash or tag).
+- `edit, e <idx>...` — edit. `--title`, `--description`, `--add-assignees/-a`, `--add-labels/-L`, `--remove-labels`, `--milestone`, `--deadline`, `--referenced-version`. To unset a value pass an empty string (`--milestone ""`).
+- `reopen, open <idx>...`
+- `close <idx>...`
+
+## `tea pulls` (aliases: `pull`, `pr`)
+Without args lists PRs; with `<index>` shows PR detail. Fields: `index,state,author,author-id,url,title,body,mergeable,base,base-commit,head,diff,patch,created,updated,deadline,assignees,milestone,labels,comments,ci`.
+
+Subcommands:
+- `list, ls` (`--state`)
+- `checkout, co <idx>` — check out PR locally. `--branch/-b` creates a local branch if missing. Needs a checkout, same as `create`: `--repo` is a path here, not a slug.
+- `clean <idx>` — delete local and remote feature branches for a closed PR. `--ignore-sha` matches branch by name instead of commit hash. Needs a checkout, same as `create`.
+- `create, c` — create a PR. `--head <user:branch>`, `--base/-b`, `--allow-maintainer-edits/--edits`, `--agit`, `--topic`, plus all issue-style fields (`--title`, `--description`, `--assignees`, `--labels`, `--milestone`, `--deadline`, `--referenced-version`).
+  **Needs a local checkout.** `--repo owner/repo` is *not* accepted here — the
+  slug fails with `local repository required: execute from a repo dir, or
+  specify a path with --repo`, whose advice reads like the flag was missing.
+  Run it with cwd inside the checkout and no `--repo`, or pass `--repo
+  /path/to/checkout`. From a git worktree, point `--repo` at the main
+  checkout. With no checkout in reach, `POST repos/{owner}/{repo}/pulls`
+  through `tea api`, which takes the slug.
+- `close <idx>...`, `reopen, open <idx>...`
+- `edit, e <idx>...` — like `issues edit` plus `--add-reviewers/-r`, `--remove-reviewers`.
+- `review <idx>` — interactive review.
+- `approve, lgtm, a <idx> [comment]`
+- `reject <idx> <reason>`
+- `merge, m <idx>` — `--style/-s {merge|rebase|squash|rebase-merge}` (default merge), `--title/-t`, `--message/-m`.
+- `review-comments, rc <idx>` — list review comments. Fields: `id,body,reviewer,path,line,resolver,created,updated,url`.
+- `resolve <comment-id>` / `unresolve <comment-id>`
+
+## `tea labels` (alias: `label`)
+- `list, ls` — `--save/-s` dumps labels to a file.
+- `create, c` — `--name`, `--color`, `--description`, `--file` (bulk import from file).
+- `update` — `--id`, `--name`, `--color`, `--description`.
+- `delete, rm` — `--id`.
+
+## `tea milestones` (aliases: `milestone`, `ms`)
+Fields: `title,state,items_open,items_closed,items,duedate,description,created,updated,closed,id`.
+
+- `list, ls` (`--state`)
+- `create, c` — `--title/-t`, `--description/-d`, `--deadline/--expires/-x`, `--state`.
+- `close <name>...` — `--force/-f` deletes instead of closing.
+- `reopen, open <name>...`
+- `delete, rm <name>`
+- `issues, i <name>` — manage milestone contents:
+  - `add, a <name> <issue-idx>`
+  - `remove, r <name> <issue-idx>`
+
+## `tea releases` (aliases: `release`, `r`)
+- `list, ls`
+- `create, c [<tag>]` — `--tag`, `--target` (branch/commit), `--title/-t`, `--note/-n`, `--note-file/-f`, `--draft/-d`, `--prerelease/-p`, `--asset/-a <path>` (repeatable).
+- `edit, e <tag>...` — `--tag`, `--target`, `--title/-t`, `--note/-n`, `--draft/-d <bool>`, `--prerelease/-p <bool>`.
+- `delete, rm <tag>...` — `--confirm/-y` required; `--delete-tag` also removes the git tag.
+- `assets, asset, a` — manage release attachments:
+  - `list, ls <tag>`
+  - `create, c <tag> <asset>...`
+  - `delete, rm <tag> <attachment-name>...` — `--confirm/-y`.
+
+## `tea times` (aliases: `time`, `t`)
+Time tracking on issues/PRs. Fields: `id,created,repo,issue,user,duration`. Command-level: `--from/-f`, `--until/-u`, `--total/-t`, `--mine/-m`.
+
+- `add, a <issue> <duration>` — e.g. `tea times add 1 1h25m`.
+- `delete, rm <issue> <time-id>`
+- `reset <issue>`
+- `list, ls [username | #issue]` — username filters by user on the repo; `#N` filters by issue; `--mine` aggregates across all repos.
+
+## `tea organizations` (aliases: `organization`, `org`)
+- `list, ls`
+- `create, c <name>` — `--full-name/-n`, `--description/-d`, `--website/-w`, `--location/-L`, `--visibility/-v`, `--repo-admins-can-change-team-access`.
+- `delete, rm <name>`
+
+## `tea repos` (alias: `repo`)
+Fields: `description,forks,id,name,owner,stars,ssh,updated,url,permission,type`.
+
+- `list, ls` — `--watched/-w`, `--starred/-s`, `--owner/-O`, `--type/-T {fork|mirror|source}`.
+- `search, s [term]` — `--topic/-t`, `--type/-T`, `--owner/-O`, `--private {true|false}`, `--archived {true|false}`.
+- `create, c` — `--name`, `--owner/-O`, `--private`, `--description/--desc`, `--init`, `--labels`, `--gitignores/--git`, `--license`, `--readme`, `--branch`, `--template`, `--trustmodel {committer|collaborator|collaborator+committer}`, `--object-format {sha1|sha256}`.
+- `create-from-template, ct` — `--template/-t`, `--name/-n`, `--owner/-O`, `--private`, `--description/--desc`, copy toggles: `--content`, `--githooks`, `--avatar`, `--labels`, `--topics`, `--webhooks`.
+- `fork, f` — `--owner/-O` (default: current user).
+- `migrate, m` — `--name`, `--owner`, `--clone-url`, `--service {git|gitea|gitlab|gogs}`, `--mirror`, `--mirror-interval`, `--private`, `--template`, copy toggles: `--wiki`, `--issues`, `--labels`, `--pull-requests`, `--releases`, `--milestones`, `--lfs`, `--lfs-endpoint`, auth: `--auth-user`, `--auth-password`, `--auth-token`.
+- `delete, rm` — `--name`, `--owner/-O`, `--force/-f`.
+- `edit, e` — `--name`, `--description/--desc`, `--website`, `--private <bool>`, `--template <bool>`, `--archived <bool>`, `--default-branch`.
+
+## `tea branches` (aliases: `branch`, `b`)
+Fields: `name,protected,user-can-merge,user-can-push,protection`.
+
+- `list, ls`
+- `protect, P <branch>` — enable branch protection.
+- `unprotect, U <branch>` — remove protection.
+- `rename, rn <old> <new>`
+
+## `tea actions` (alias: `action`)
+CI management: secrets, variables, workflow definitions, workflow runs.
+
+### `tea actions secrets` (alias: `secret`)
+- `list, ls`
+- `create, add, set <name> [value]` — `--file` or `--stdin` to read the value.
+- `delete, remove, rm <name>` — `--confirm/-y`.
+
+### `tea actions variables` (aliases: `variable`, `vars`, `var`)
+- `list, ls` — `--name` to fetch a single variable.
+- `set, create, update <name> [value]` — `--file`, `--stdin`.
+- `delete, remove, rm <name>` — `--confirm/-y`.
+
+### `tea actions runs` (alias: `run`)
+- `list, ls` — `--status {success|failure|pending|queued|in_progress|skipped|canceled}`, `--branch`, `--event`, `--actor`, `--since`, `--until`.
+- `view, show, get <run-id>` — `--jobs` prints the jobs table.
+- `delete, remove, rm, cancel <run-id>` — `--confirm/-y`.
+- `logs, log <run-id>` — `--job <id>`, `--follow/-f` (requires the job to be in progress).
+
+### `tea actions workflows` (alias: `workflow`)
+- `list, ls`
+- `view, show, get <workflow-id>`
+- `dispatch, trigger, run <workflow-id>` — `--ref/-r`, `--input/-i key=value` (repeatable), `--follow/-f`.
+- `enable <workflow-id>`
+- `disable <workflow-id>` — `--confirm/-y`.
+
+## `tea webhooks` (aliases: `webhook`, `hooks`, `hook`)
+Scope is selected by flag: `--repo`, `--org`, `--global`.
+
+- `list, ls`
+- `create, c <webhook-url>` — `--type {gitea|gogs|slack|discord|dingtalk|telegram|msteams|feishu|wechatwork|packagist}` (default: gitea), `--secret`, `--events` (default: push), `--active`, `--branch-filter`, `--authorization-header`.
+- `update, edit, u <id>` — `--url`, `--secret`, `--events`, `--active` / `--inactive`, `--branch-filter`, `--authorization-header`.
+- `delete, rm <id>` — `--confirm/-y`.
+
+## `tea comment, c <issue/pr index> [body]`
+Add a comment to an issue or PR. Body may be passed as an argument or supplied interactively.