[FEAT] forgejo issue write ops — create (with labels), comment, comments, close zombie check #16

Purpose

The Forgejo workflow in ai-shared-rules/github-rules.md still shells out to fj for issues — text output, no labels on create (second call), backtick substitution in comments. Cover the issue side with REST tools so fj is no longer needed for it.

Scope

• new src/tools/forgejo-issue-create.ts, forgejo-issue-comment.ts, forgejo-issue-comments.ts
• src/tools/forgejo-issue-close.ts — zombie check
• src/lib/forgejo-utils.ts — label name → id resolver
• src/four-opencode-git.ts (register), tests/forgejo-tools.test.ts, AGENTS.md, README.md

Out of Scope

PR tools (next issue). Editing labels on existing issues. Rules update in ai-shared-rules (separate repo).

Steps

1. forgejo_issue_create — title, body, labels[] (names). Resolve names via GET /repos/{o}/{r}/labels; any unknown name → refuse, create nothing (Unknown label(s): x — run rollout-defekt-labels --apply). POST /issues with labels ids. Returns #N url.
2. forgejo_issue_comment — POST /issues/{n}/comments; body is a tool argument (never shell). Works for PRs too (same index space). Returns the comment URL.
3. forgejo_issue_comments — GET /issues/{n}/comments, newest limit (default 10), one line each: author date: first line… (truncated).
4. forgejo_issue_close — zombie check mirroring gh_issue_close: warn when the issue references no merged PR.
5. Register, fixture tests, docs (tool count 22 → 25).

AC

• Create with an unknown label makes no POST /issues call
• Create with known labels sends their ids in one call
• Comment text with backticks/$() arrives verbatim (fixture asserts request body)
• Comments list is one line per comment, body truncated
• All tools return the not-configured line without config; none throws
• bun test, tsc --noEmit green

Constraints

Depends on the secrets/host-binding issue. Fixture JSON only, no live API in tests.

Escalation triggers

Forgejo API rejecting label ids on create (would need a second call).