Merge main into watchpr auth failure branch

Keep both sides' additions to client_test.go and adopt main's
EditPROptions -> EditOptions rename.

README.md

@@ -6,8 +6,8 @@ token from Vault, so automated PRs, comments and pushes are attributed to the
 agent — not to whoever happens to run the command. Set `AGENT_LOGIN` to act as a
 different agent identity.
 
-- **`agentpr`** — create and edit pull requests, and post PR comments as the
-  agent user.
+- **`agentpr`** — create and edit pull requests and issues, and post comments on
+  either, as the agent user.
 - **`watchpr`** — poll one or more PRs and exit when one changes in a way worth
   acting on.
 - **`agentws`** — manage per-branch git worktrees for `unkin-agent`, cloning
@@ -56,6 +56,18 @@ agentpr pr edit --repo unkin/argocd-apps --pr 42 --body "Adds the ServiceAccount
 agentpr pr edit --repo unkin/argocd-apps --pr 42 --title "Add woodpecker SA"
 # prints: #<number> <html_url>
 
+# File an issue (--body optional)
+agentpr issue create --repo unkin/argocd-apps \
+  --title "Woodpecker SA missing" --body "The pipeline fails with ..."
+# prints: #<number> <html_url>
+
+# Comment on an issue (the same Gitea endpoint `pr comment` posts to)
+agentpr issue comment --repo unkin/argocd-apps --issue 43 --body "Fixed in #44."
+
+# Edit an issue's title and/or body; an omitted flag is left unchanged
+agentpr issue edit --repo unkin/argocd-apps --issue 43 --body "The pipeline fails with ..."
+# prints: #<number> <html_url>
+
 agentpr --version
 agentpr --help
 ```
@@ -116,10 +128,10 @@ checkout too; the worktrees themselves live under the **worktree root**
 
 ```bash
 # Clone unkin/argocd-apps into ~/src/prodenv if missing, then add a worktree for
-# a new branch off the remote default branch. Prints the worktree path.
+# the branch. Prints the worktree path.
 agentws new argocd-apps --branch benvin/my-change
 
-# Branch off a specific base instead of the remote default
+# Branch off a specific base instead of the remote default (new branches only)
 agentws new argocd-apps --branch benvin/hotfix --from release-1.2
 
 # List managed worktrees (repo, branch, path)
@@ -143,6 +155,20 @@ agentws clean
 agentws token
 ```
 
+`agentws new` fetches first, then takes one of two paths and names the one it
+took on its last output line. A branch that **already exists on origin** is
+checked out at `origin/<branch>` and set to track it, so the worktree starts on
+the branch's own commits (`branch <b> (tracking origin/<b> at <sha>)`); a local
+branch left from an earlier run is fast-forwarded onto it. A branch origin does
+**not** have is created from `--from`, or from the remote's default branch when
+`--from` is absent (`branch <b> (new, from origin/<base>)`) — the default is read
+from `origin/HEAD`, so a repo on `master` forks from `master`. `--from` is
+ignored, with a note, when the branch is already on origin.
+
+The one case the worktree does not land on `origin/<branch>` is a local branch
+carrying commits origin has never seen. Those commits exist nowhere else, so the
+checkout is left on them and the output says how many.
+
 ### prune
 
 `agentws prune` finds worktrees two ways and merges the results: the managed