feat: integrate tea CLI for forge issue/label/comment operations (#666)

- Add lib/tea-helpers.sh with tea_file_issue, tea_relabel, tea_comment,
  tea_close — thin wrappers preserving secret scanning on write ops
- Add tea 0.9.2 binary to docker/agents/Dockerfile
- Configure tea login in docker/agents/entrypoint.sh from FORGE_TOKEN/FORGE_URL
- Derive TEA_LOGIN in lib/env.sh (codeberg vs local forgejo)
- Source tea-helpers.sh conditionally when tea binary is available
- Migrate predictor formula from inline curl to tea CLI commands
- Register tea-helpers.sh in smoke test function resolution

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker/agents/Dockerfile

@@ -4,6 +4,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     bash curl git jq tmux cron python3 openssh-client ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
+# tea CLI — official Gitea/Forgejo CLI for issue/label/comment operations
+RUN curl -sL https://dl.gitea.com/tea/0.9.2/tea-0.9.2-linux-amd64 -o /usr/local/bin/tea \
+    && chmod +x /usr/local/bin/tea
+
 # Claude CLI is mounted from the host via docker-compose volume.
 # No internet access to cli.anthropic.com required at build time.
 

docker/agents/entrypoint.sh

@@ -57,6 +57,24 @@ log "Claude CLI: $(claude --version 2>&1 || true)"
 
 install_project_crons
 
+# Configure tea CLI login for forge operations (runs as agent user).
+# tea stores config in ~/.config/tea/ — persistent across container restarts
+# only if that directory is on a mounted volume.
+if command -v tea &>/dev/null && [ -n "${FORGE_TOKEN:-}" ] && [ -n "${FORGE_URL:-}" ]; then
+  local_tea_login="forgejo"
+  case "$FORGE_URL" in
+    *codeberg.org*) local_tea_login="codeberg" ;;
+  esac
+  su -s /bin/bash agent -c "tea login add \
+    --name '${local_tea_login}' \
+    --url '${FORGE_URL}' \
+    --token '${FORGE_TOKEN}' \
+    --no-version-check 2>/dev/null || true"
+  log "tea login configured: ${local_tea_login} → ${FORGE_URL}"
+else
+  log "tea login: skipped (tea not found or FORGE_TOKEN/FORGE_URL not set)"
+fi
+
 # Start matrix listener in background (if configured)
 if [ -n "${MATRIX_TOKEN:-}" ] && [ -n "${MATRIX_ROOM_ID:-}" ]; then
   log "Starting matrix listener in background"