feat!: rebuild tea on Cobra with explicit noun/verb commands (#1126)

- **switch tea to the Cobra command tree:** `internal/app` wires the packages from parts 1–4 into explicit noun/verb commands with `--repo`, `--json` / `--jq`, `--sudo` and `--debug`; `main.go` points at it. Build, release and docs tooling (`tools/cli-docs`, Makefile, goreleaser, snap, CI) and README / CONTRIBUTING are updated.
- **remove the urfave/cli command tree:** deletes `cmd/`, `modules/`, the old integration tests, contrib completion scripts and the generated `docs/CLI.md`, and drops their dependencies. This commit only deletes.

## Breaking changes

This is a breaking release. It requires Gitea 28 or newer; configuration moves to separate `config.yml` and `hosts.yml` files and requires fresh authentication, and command names, aliases, flags and output formats change. `docs/migration-1.0.md` maps every old command, flag and environment variable to its replacement.

## Issues

fixes #1118
fixes #1116
fixes #1115
fixes #1094
fixes #1091
fixes #1073
fixes #1052
fixes #1032
fixes #1023
fixes #966
fixes #908
fixes #833
fixes #831
fixes #817
fixes #804
fixes #779
fixes #770
fixes #737
fixes #697
fixes #726
fixes #677
fixes #672
fixes #633
fixes #632
fixes #560
fixes #556
fixes #523
fixes #516
fixes #510
fixes #504
fixes #500
fixes #482
fixes #406
fixes #403
fixes #373
fixes #351
fixes #344
fixes #326
fixes #325
fixes #323
fixes #246
fixes #240
fixes #232
fixes #197
fixes #172
fixes #141
fixes #69
fixes #1110
fixes #569
fixes #480
fixes #666
fixes #670
fixes #457
fixes #643
fixes #498
fixes #490
fixes #1069
fixes #834
fixes #602
fixes #328
fixes #417
fixes #571
fixes #1029
fixes #489
fixes #1050
fixes #162
fixes #430
fixes #1087
fixes #683

Reviewed-on: https://gitea.com/gitea/tea/pulls/1126
Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com>

internal/app/artifacts_test.go

@@ -0,0 +1,54 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package app
+
+import (
+	"context"
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestArtifactDownloadsValidateDestinationAndKeepBinaryOutputClean(t *testing.T) {
+	requests := 0
+	server := newAuthenticatedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests++
+		switch r.URL.Path {
+		case "/api/v1/repos/owner/repo/actions/artifacts/9/zip":
+			require.Equal(t, "token token", r.Header.Get("Authorization"))
+			http.Redirect(w, r, "/signed?signature=private", http.StatusFound)
+		case "/signed":
+			require.Empty(t, r.Header.Get("Authorization"))
+			_, _ = w.Write([]byte{0x50, 0x4b, 0, 0xff})
+		default:
+			t.Errorf("unexpected endpoint %s", r.URL.Path)
+			w.WriteHeader(404)
+		}
+	}))
+	defer server.Close()
+	deps, out, diagnostics := serverDeps(t, server.URL)
+	args := []string{"run", "artifact", "download", "9", "-R", "owner/repo", "--output-file", "-"}
+	require.NoError(t, Execute(context.Background(), deps, args))
+	require.Equal(t, []byte{0x50, 0x4b, 0, 0xff}, out.Bytes())
+	require.Empty(t, diagnostics.String())
+	output := filepath.Join(t.TempDir(), "artifact.zip")
+	args[len(args)-1] = output
+	out.Reset()
+	require.NoError(t, Execute(context.Background(), deps, args))
+	data, err := os.ReadFile(output)
+	require.NoError(t, err)
+	require.Equal(t, []byte{0x50, 0x4b, 0, 0xff}, data)
+	require.Empty(t, out.String())
+	before := requests
+	err = Execute(context.Background(), deps, args)
+	require.ErrorContains(t, err, "already exists")
+	require.Equal(t, before, requests)
+	args[len(args)-1] = "-"
+	err = Execute(context.Background(), deps, append(args, "--json"))
+	require.ErrorContains(t, err, "binary")
+	require.Equal(t, before, requests)
+}