agentpr: close and reopen issues

- add issue close and issue reopen subcommands
- add GetIssue and SetIssueState to the Gitea client
- fail when the issue is already in the requested state
- document the new subcommands in README.md and AGENTS.md

AGENTS.md

@@ -8,10 +8,11 @@ from Vault, so actions are attributed to the agent rather than to whoever runs
 the tool. Setting `AGENT_LOGIN` selects a different agent identity, so a service
 like repospawner can run these tools as itself.
 
-- **`agentpr`** — create and edit pull requests and issues, and post comments on
-  either, as `unkin-agent` (fixes the "tea posts as Ben" attribution problem).
-  Subcommands: `pr create`, `pr comment`, `pr edit`, `issue create`,
-  `issue comment`, `issue edit`, `whoami`.
+- **`agentpr`** — create and edit pull requests and issues, close and reopen
+  issues, and post comments on either, as `unkin-agent` (fixes the "tea posts
+  as Ben" attribution problem). Subcommands: `pr create`, `pr comment`,
+  `pr edit`, `issue create`, `issue comment`, `issue edit`, `issue close`,
+  `issue reopen`, `whoami`.
 - **`watchpr`** — poll one or more PRs and exit when a tracked PR changes
   meaningfully: it merges/closes, gets a new non-agent comment, its CI fails,
   or it loses mergeability. Benign transitions (CI pending→success, the agent's
@@ -29,7 +30,7 @@ parsing, watch-state comparison, git worktree helpers).
 ## Structure
 
 ```
-cmd/agentpr/main.go      # agentpr CLI (pr + issue create/comment/edit, whoami)
+cmd/agentpr/main.go      # agentpr CLI (pr + issue create/comment/edit, issue close/reopen, whoami)
 cmd/watchpr/main.go      # watchpr CLI (poll + meaningful-change exit)
 cmd/agentws/main.go      # agentws CLI (new / list / rm / clean / token / credential)
 cmd/agentws/prune.go     # agentws prune (classify worktrees, remove the safe ones)
@@ -37,7 +38,7 @@ cmd/agentvault/main.go   # agentvault CLI (seed-outpost / seed-oauth)
 internal/agent/          # shared plumbing:
   token.go               #   env config + in-process Gitea-token cache
   vault.go               #   AppRole login + read the gitea creds path
-  gitea.go               #   Gitea REST client (PR/issue create/edit/get, comments, status, whoami)
+  gitea.go               #   Gitea REST client (PR/issue create/edit/get, issue state, comments, status, whoami)
   parse.go               #   owner/repo#N and owner/repo parsing
   watch.go               #   PRState snapshot + MeaningfulChange comparison
   git.go                 #   git worktree/clone/fetch helpers (os/exec, no go-git)
@@ -131,7 +132,8 @@ make test           # go test -v -race ./...
 `internal/agent` covers PR-ref parsing, the `MeaningfulChange` table (benign vs
 alerting transitions), request-body construction, and the Vault+Gitea client
 against `httptest` servers (fake AppRole login + gitea creds + PR/issue create
-+ edit / comment / whoami / status). No live Vault/Gitea access is required for tests.
++ edit / close / reopen / comment / whoami / status). No live Vault/Gitea access
+is required for tests.
 
 ## agentvault seed-outpost
 
@@ -223,3 +225,7 @@ wrapped per stage (login / read denied / write denied) via `ErrVaultDenied`.
 - Gitea backs every PR with an issue of the same number and serves comments from
   `/issues/{n}/comments`, so `agentpr pr comment` and `agentpr issue comment`
   are one implementation under two flag names (`--pr` / `--issue`).
+- `issue close`/`issue reopen` read the issue before the PATCH: Gitea answers a
+  no-op state change with 200, so without the read an already-closed issue would
+  report success. There is no `pr close`: closing a pull request is a human's
+  call, not an agent's.