Slice 6: right-click command menu + git write actions

git boundary: Pull/Push/Commit/DiscardAll (discard is 1.4-destructive). Scanner.RefreshRepo re-scans one repo after a mutation. Service GitFetch/GitPull/GitPush/GitCommit/GitDiscard record a git-* activity event and refresh on success; service.New takes a refresh hook. HTTP POST /api/repo/git. New <repo-menu> overlay with plain-language commands (Get latest/Publish/Check for updates/Save my work/Set active/Ask Claude to switch/Copy path/Discard all changes), summoned by repo-list's repo:contextmenu. Added service test for commit/discard on a temp repo. Verified the menu live for safe commands.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -159,3 +159,32 @@ Append-only running history of all changes (AGENT.md §9.1). Newest last.
 - **Not yet live-tested:** needs `GITEA_URL`+`GITEA_TOKEN` set and a real PR;
   build/vet/tests pass and the parser is unit-tested. A real merge is irreversible
   — will only run one against a PR Thomas designates, with confirmation.
+
+## 2026-09-20 — Forge live-tested (Merge & clean up)
+- **What:** With `GITEA_URL`+`GITEA_TOKEN` set, verified end-to-end against
+  git.nilles.net: created an isolated throwaway PR via the Gitea API (on a
+  dedicated base branch so `main` was untouched), listed it through `GET
+  /api/repo/prs`, then ran `POST /api/repo/pr/merge` → `{merged:true,
+  branchDeleted:true}`; confirmed the branch was gone (404), the PR list emptied,
+  and the feed logged `pr-merged`. Cleaned up the base branch afterward.
+- **Why:** Prove the write path with real auth before relying on it.
+- **Affects:** none (runtime verification only; no code change).
+
+## 2026-09-20 — Slice 6: right-click command menu + git write actions (§6)
+- **What:** git boundary gained `Pull`/`Push`/`Commit`/`DiscardAll` (the last is
+  §1.4-destructive). Scanner got `RefreshRepo` (single-repo re-scan). Service
+  gained `GitFetch/GitPull/GitPush/GitCommit/GitDiscard` — each records a `git-*`
+  activity event (ok/failed) and refreshes the repo after success; `service.New`
+  takes a refresh hook. New HTTP `POST /api/repo/git {path, op, message?}`. New
+  `<repo-menu>` overlay (plain-language commands: Get latest, Publish, Check for
+  updates, Save my work…, Set as active project, Ask Claude to switch here, Copy
+  path, and the confirmed Discard all changes…); `<repo-list>` emits
+  `repo:contextmenu` on right-click. Added `internal/service` test covering
+  commit/discard on a temp repo.
+- **Why:** The GUI-first reason the app exists (§0) — run git in plain language
+  without a terminal. Logic lives in the shared service (§1.7) so the same ops can
+  be exposed to Claude via MCP next.
+- **Affects:** `internal/git`, `internal/repos`, `internal/service` (+test),
+  `cmd/server/main.go`, `components/repo-menu` (new), `components/repo-list`,
+  `web/templates/{index,help}.html`.
+- **Next:** expose these git ops as MCP tools so Claude can run them too.