feat: drop the local copy after a successful push

Gitea becomes the source of truth. Once a push is confirmed, push.py
deletes tmp/issues/<id>.md and <id>.comments.md and prints the number and
URL the issue now lives at; the current state is obtained by pulling
again rather than by reconciling. --update follows the same rule, with no
exception: what is local is what has not left.

This reverses three statements AGENTS.md used to make, and rewriting them
is part of the change:

  - "tmp/issues/ is the store, not a cache of Gitea" — it is both, split
    by origin:. An origin: local file is the only copy of the work; an
    origin: gitea file is a deletable working copy.
  - "Pushing is additive: the file is never deleted" — it is deleted.
  - "origin: local is a durable state" — complete, but not durable:
    pushing ends it.

Slug stability, which the format promises for the life of an issue, can
no longer rest on a file push is about to delete. The slug goes up in the
body as a hidden marker, <!-- tea:id <slug> -->, on the first line:
map.to_payload strips every marker and prepends exactly one, map.from_api
strips every marker on the way down, so the local file never holds one
and a body cannot accumulate them however many round trips it makes. The
marker survives a rename in the web UI, a lost .remote.json, a fresh
clone and another machine — none of which a local index does.

Deletion is the last thing that happens to an issue and only after the
transport returned, the answer carried a positive integer number (and, on
--update, the number that was PATCHed — push.confirmed_number), and
.remote.json was written. A raised transport, a non-2xx, an empty or
mismatched body each leave the file on disk and stop the run.

.remote.json is no longer "only an index over the files": its entries now
deliberately outlive them, so it is the local number -> slug ledger and
rebuild_map merges into it instead of reconstructing it from files that
may be gone. It stays recoverable, from the markers in Gitea rather than
from the files. push.dep_state reads it too, so a blocker whose file an
earlier push dropped still gets its native dependency link.

Also fixes a pre-existing bug the new tests hit: issue.all_ids treated
<id>.comments.md as an issue called "<id>.comments", so a bare push.py in
a store holding pulled threads tried to file a comment thread as a unit
of work. A slug has no dot in it.

tests/test_drop_after_push.py covers the round trip (push -> gone -> pull
-> identical in slug, depends: and body), the marker's algebra, and every
failure path separately. test_push_dependencies.py is updated where it
encoded the old "never deleted" contract. 183 tests, no network.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

skills/issue/references/format.md

@@ -14,13 +14,22 @@ sync layer's business — see `/tea:sync`.
 An issue is one file, `tmp/issues/<id>.md`, and `id` is a slug: lowercase
 ASCII, digits, single dashes, derived from the title. **The slug is the
 identity.** It is stable for the life of the issue — a retitled issue keeps its
-slug, and an issue pushed to a tracker keeps it too. Tracker numbers are a
-foreign key stored in a field, never the name of anything.
+slug; an issue pushed to a tracker, deleted locally and fetched back a month
+later keeps it too. Tracker numbers are a foreign key stored in a field, never
+the name of anything.
 
 ```
 tmp/issues/wire-sqlc-appclick.md
 ```
 
+A slug never contains a dot, which is how the store tells an issue from the
+files parked beside it (`<id>.comments.md`).
+
+Stability is a promise the format makes, so something has to keep it once the
+file is gone. That is the sync layer's problem and its answer is a marker in the
+body — see `/tea:sync`; the domain neither writes nor reads it, and it never
+appears in the file on disk.
+
 ## Metadata block
 
 One field per line, lists inline, so plain `grep` works without a parser:
@@ -67,8 +76,25 @@ sync layer's business — the domain carries `gitea:` and the rest through
 load/save verbatim and never reads them. That passthrough is why one file can
 represent a local issue and a synced one without a second format.
 
-`origin: local` is a **durable state, not a pending one.** An issue that never
-leaves this machine is complete and valid. Pushing is optional and additive.
+`origin: local` is a **complete state, not a pending one.** An issue that never
+leaves this machine is valid and finished work; pushing it is optional and
+nothing here treats it as a draft.
+
+It is not a *permanent* state, and this is the one place where the file's fate
+depends on it:
+
+| `origin:` | what the file is | what a push does to it |
+|---|---|---|
+| `local` | the issue itself — the only copy there is | creates it in the tracker, then deletes the file |
+| a tracker | a working copy of something the tracker already has | updates the tracker, then deletes the file |
+
+**A successful push deletes `tmp/issues/<id>.md`** (and `<id>.comments.md`), on
+create and on `--update` alike. What is in the store is what has not left this
+machine; everything else is fetched again when it is needed. The rule, its
+safety conditions, and how the slug survives are `/tea:sync`'s to state.
+
+The `id` never changes across that round trip, which is why `depends:` in other
+issues keeps working. That is the format's promise; the mechanism is not.
 
 ## Language rules