Merge origin/main into feat/evict-closed-issues

Three doc conflicts, all unions: the script lists in AGENTS.md and the runner
gain both close.py and evict.py, and the sync skill keeps both the closing and
the evicting sections. Rule 4 of the runner is rewritten once to carry both
halves — closing is now a script it may run on named ids, retitling and remote
deletion stay forbidden, and the two allowed local deletions (push's own, and
eviction) are listed together.

agents/tea-runner.md

@@ -29,8 +29,8 @@ to fill the gap yourself.
 
 Load the skill, do not remember the flags:
 
-- `/tea:sync` — `pull.py`, `push.py`, `comment.py`, `remote.py`, `labels.py`,
-  `evict.py`
+- `/tea:sync` — `pull.py`, `push.py`, `comment.py`, `close.py`, `remote.py`,
+  `labels.py`, `evict.py`
 - `/tea:issue` — `issue_check.py`, `issue_tree.py`, `issue_index.py`,
   `issue_new.py`, `issue_ac.py`, `issue_evict.py`
 - `/tea:wiki` — `wiki_ls.py`, `wiki_pull.py`, `wiki_push.py`
@@ -66,15 +66,23 @@ instead of trying it.
    `wiki_push.py` needs `-m`; use the caller's words, never your own summary.
    Report the number and URL `push.py` printed; that is now the only address
    the issue has.
-4. **Do not close, delete, or retitle anything** on either side. On the wiki
-   that means no `--retitle`: renaming a published page abandons the old one.
-   Two deletions are allowed, both local and both only when the caller asked for
-   them: push's own, on the issue you were told to push, and eviction
+4. **Close only the ids the caller named.** Closing is a script now
+   (`close.py`), so it is yours to run — under the same discipline as push: the
+   ids the caller named, and no others. Never widen the set, never infer that
+   an issue is finished because its checkboxes are ticked or its branch is
+   merged; whether work is done is a judgement about content, and content is
+   never yours. `--reopen` is the same rule backwards. **Retitling stays
+   forbidden** on both sides — on the wiki that means no `--retitle`, since
+   renaming a published page abandons the old one, and deleting anything on a
+   tracker is never yours either.
+
+   Two local deletions are allowed, both only when the caller asked for them:
+   push's own, on the issue you were told to push, and eviction
    (`issue_evict.py` / `evict.py`) of closed issues. Run eviction with
-   `--dry-run` first and report what it named; never widen the set past what the
-   caller said. It refuses to touch an `origin: local` issue by itself — that is
-   the script's guarantee, not your judgement, and it is not a reason to point
-   it at a store nobody asked you to clean.
+   `--dry-run` first and report what it named; never widen the set past what
+   the caller said. It refuses to touch an `origin: local` issue by itself —
+   that is the script's guarantee, not your judgement, and it is not a reason
+   to point it at a store nobody asked you to clean.
 5. **One retry, maximum.** A command that fails twice is a finding. Do not
    permute flags looking for one that works.
 6. **No payload dumps.** Never run `tea issues -o json`, never `cat` a pulled
@@ -128,3 +136,4 @@ Report these and halt; none of them is yours to resolve.
 | a dependency is still `origin: local` | name the id; the caller decides whether to push it |
 | a milestone or label does not exist in the repo | the script prints the real ones — pass that list through |
 | a script asks for a decision (type, label, `--force`) | `blocked:` with the question |
+| `close.py` is refused by Gitea because the issue is still blocked | the tracker's own line, and the blocker's number; the caller decides |