v0.4.0

Pull request actions (merge, review, request reviewers, comment, update branch)
in the review panel and as agent tools, and review watches with cleanup. Adds no
capability, so there is no re-approval prompt. Verified against Gitea 1.20 and
1.27 and Forgejo 7 and 16, and on a real Kandev 0.97.0.

• Fixed after the first real-installation run of 0.4.0-rc.1:

  • A watch labelled with a name no issue carries matched every issue, because
    Forgejo and Gitea ignore an unknown label name instead of matching nothing.
    Issue and review watches now check the labels each result really carries.
  • A malformed watch body (a wrong type, invalid JSON) and a
    change_requests.link or .unlink body with a missing or wrong field came
    back as 503 "plugin action unavailable". They are now 422 with the reason.
    watches.create and watches.update also accept repos as the
    {owner, name} objects watches.list returns.
  • The fork guard now also refuses a column whose on_enter actions include
    queue_run, queue_run_for_each_participant or run_code_review, not only
    auto_start_agent, and reports a fork task that workflow automation moved out
    of the column it was filed in.

• A merge blocked by required approvals is now reported as branch protection.
  Every host answers it with 405 and not allowed to merge [reason: …], which
  was read as a permission problem. A token missing a scope is now a permission
  problem rather than branch protection, and the message names write:repository
  and write:issue (comments and labels need the latter, the review search
  read:issue).

• Review watches. A new watch kind, next to issue watches, files a task for
  every pull request that asks for your review (the instance's own
  review_requested search, so team requests count by default, with an "only me"
  scope that checks the reviewer list). Tasks get the title PR #N: …, a prompt
  with {{pr.*}} placeholders filled in (a default modelled on Kandev's GitHub
  review prompt), and, for same-repository pull requests, the head branch checked
  out. Drafts are left out unless asked for, using the draft field or a WIP:
  title prefix. Settings: scope, drafts, repositories, labels, search, column,
  profiles, interval (60 s floor), open task limit. See
  Review watches.

• Fork pull requests never start an agent on their own. The plugin cannot
  set Kandev's manual-start marker, so a fork's task is never started, never has
  the fork's branch checked out, and lands in a column that does not start agents
  (a per-watch "fork column") or is left out and counted. The column is checked
  again on every run, and a fork column that starts agents is refused at save.
  Documented as weaker than GitHub's in docs/security.md.

• Cleanup. A review watch can retire the task of a merged or closed pull
  request: archived through the host's exact archive command (on Kandev 0.97.0 the
  approval for it comes with the plugin's one capability approval), completed
  when the host cannot (and the watch says which). A completed task no longer
  counts against the open task limit. Never deleted. Opt-in
  per watch, no instance request for tasks already archived or complete, at most
  40 checks per pass, and a rate limit or refused token ends the pass. New action
  watches.cleanup ("Clean up now"), which brings the manifest to 27 actions.

• Watch errors now reach the operator. The host replaces any Go error from an
  action with "plugin action unavailable", so a rejected watch (a missing name or
  workflow, a bad repository, a fork column that starts agents) showed that
  instead of the reason. Validation failures, a missing watch, a paused watch and
  the like now travel as 422, 404 or 409 with their message.

• Review watches are stored under their own rwatch. key prefix, and issue
  watches are stored byte-for-byte as before, so downgrading to 0.3.x leaves
  issue watches working and review watches unseen. watches.list takes an
  optional kind; watches.options also returns the review minimum interval,
  the default prompt, whether archiving is granted, and which steps start agents.

• No new capability. Verified against Gitea 1.20 and 1.27 and Forgejo 7 and 16
  (TestLiveReviewRequestedSearch); the probe results are in
  docs/development.md.

• The review panel is now fully wired. It loads the real pull request detail
  (author, branches, line counts, reviews, requested reviewers, checks, comments)
  through change_requests.details, shows why a merge is blocked, and offers
  merge (with the styles the repository allows and a delete-branch option),
  a review dialog (approve, request changes, comment, inline comments) and a
  comment box. Verified against a real Kandev 0.97.0 and Forgejo 16.

• Writes are audited. Each leaves an entry (actor, task, pull request number,
  action, outcome, never text) in Host state, readable through the new
  connection.audit action, because a plugin's stderr never reaches Kandev's
  log on v0.97.0.

• The pr agent tool gains merge, review, request_review, update and
  comment, acting on the task's one linked pull request (several linked: it
  refuses). get now reports the head sha, which merge requires. Agents
  cannot merge until an operator switches it on for the workspace (new toggle in
  the connection panel, action connection.set_agent_merge); with it on, merge
  still refuses conflicts, missing approvals and failing or running checks. The
  tool is now annotated destructive_hint: true and idempotent_hint: false,
  which was previously understated. The definition grows from 591 to 999 bytes,
  inside the existing ceilings.

• Five write actions on a linked pull request: change_requests.merge,
  .review, .request_reviewers, .update_branch and .comment. Each acts only
  on a pull request the task has linked, merge requires the head SHA the caller
  last saw, reviews and comments end with "Posted via Kandev.", and each write
  logs one audit line (action, actor, task, number, outcome). Nothing calls them
  yet; the review panel buttons and the agent tool ops follow. No new capability.

• A merge by a user without merge permission is now reported as a permission
  problem. Gitea and Forgejo answer it with 405, which was read as "not
  mergeable", and Gitea 1.27's write permission is required was read as branch
  protection.

• New read action change_requests.details: everything the review panel needs
  for one linked pull request in a single bounded response (merge styles the
  repository allows, why a merge is blocked, reviews, requested reviewers,
  comments). It only answers for a pull request the task has linked, and parts
  the token cannot see come back empty rather than failing the read. Nothing
  calls it yet; the panel and the write actions follow. A mergeable: false newer
  than 30 seconds is reported as unknown: Gitea briefly reads false on a healthy
  pull request, and a wrong "has conflicts" would block a clean merge.

• Groundwork for PR actions (client layer only, no user-visible change yet):
  writes now classify failures into fixed reasons (not mergeable, conflict, out
  of date, head changed, blocked by protection, self-review, forbidden), so a
  403 on a write no longer reads as "the instance rejected the access token".
  Adds merge, review, reviewer, update-branch, files, commits, diff, comment,
  label and assignee calls to the Forgejo client.

• New plugin icon: the Forgejo branch mark drawn as a dot matrix, in Forgejo
  orange inside a Kandev-indigo frame, on a dark rounded plate so it reads the
  same on light and dark themes. It replaces the plain outline icon in the
  marketplace and plugin lists. The in-app icon is unchanged: it keeps
  currentColor so it follows the host's theme and status colours.

• Adds the logo to the top of the README. assets/logo-dotmatrix.svg is the
  transparent mark for dark backgrounds and assets/logo-dotmatrix-light.svg a
  variant for white ones.