Merge main into watchpr auth failure branch

Keep both sides' additions to client_test.go and adopt main's
EditPROptions -> EditOptions rename.

AGENTS.md

@@ -8,9 +8,10 @@ from Vault, so actions are attributed to the agent rather than to whoever runs
 the tool. Setting `AGENT_LOGIN` selects a different agent identity, so a service
 like repospawner can run these tools as itself.
 
-- **`agentpr`** — create and edit pull requests, and post PR comments, as
-  `unkin-agent` (fixes the "tea posts as Ben" attribution problem).
-  Subcommands: `pr create`, `pr comment`, `pr edit`, `whoami`.
+- **`agentpr`** — create and edit pull requests and issues, and post comments on
+  either, as `unkin-agent` (fixes the "tea posts as Ben" attribution problem).
+  Subcommands: `pr create`, `pr comment`, `pr edit`, `issue create`,
+  `issue comment`, `issue edit`, `whoami`.
 - **`watchpr`** — poll one or more PRs and exit when a tracked PR changes
   meaningfully: it merges/closes, gets a new non-agent comment, its CI fails,
   or it loses mergeability. Benign transitions (CI pending→success, the agent's
@@ -28,7 +29,7 @@ parsing, watch-state comparison, git worktree helpers).
 ## Structure
 
 ```
-cmd/agentpr/main.go      # agentpr CLI (pr create / pr comment / pr edit / whoami)
+cmd/agentpr/main.go      # agentpr CLI (pr + issue create/comment/edit, whoami)
 cmd/watchpr/main.go      # watchpr CLI (poll + meaningful-change exit)
 cmd/agentws/main.go      # agentws CLI (new / list / rm / clean / token / credential)
 cmd/agentws/prune.go     # agentws prune (classify worktrees, remove the safe ones)
@@ -36,7 +37,7 @@ cmd/agentvault/main.go   # agentvault CLI (seed-outpost / seed-oauth)
 internal/agent/          # shared plumbing:
   token.go               #   env config + in-process Gitea-token cache
   vault.go               #   AppRole login + read the gitea creds path
-  gitea.go               #   Gitea REST client (PR create/edit/get, comments, status, whoami)
+  gitea.go               #   Gitea REST client (PR/issue create/edit/get, comments, status, whoami)
   parse.go               #   owner/repo#N and owner/repo parsing
   watch.go               #   PRState snapshot + MeaningfulChange comparison
   git.go                 #   git worktree/clone/fetch helpers (os/exec, no go-git)
@@ -129,8 +130,8 @@ make test           # go test -v -race ./...
 
 `internal/agent` covers PR-ref parsing, the `MeaningfulChange` table (benign vs
 alerting transitions), request-body construction, and the Vault+Gitea client
-against `httptest` servers (fake AppRole login + gitea creds + PR create /
-comment / whoami / status). No live Vault/Gitea access is required for tests.
+against `httptest` servers (fake AppRole login + gitea creds + PR/issue create
++ edit / comment / whoami / status). No live Vault/Gitea access is required for tests.
 
 ## agentvault seed-outpost
 
@@ -219,3 +220,6 @@ wrapped per stage (login / read denied / write denied) via `ErrVaultDenied`.
   worktree root.
 - CI "combined status" comes from `/commits/{sha}/status`; an empty head SHA
   yields an empty state without an API call.
+- Gitea backs every PR with an issue of the same number and serves comments from
+  `/issues/{n}/comments`, so `agentpr pr comment` and `agentpr issue comment`
+  are one implementation under two flag names (`--pr` / `--issue`).