feat(tbd_ship): gate auto-merge on the risk tier; unclassified is not low (gitea-mcp#63)

tbd_ship takes an optional `issue`; the PR is squash-merged only when CI is fully green, the base is not
review-protected AND the issue carries exactly one risk/ label, risk/low. No issue, no label, several labels,
an unknown value, risk/medium, risk/high or an unreadable issue all fail closed to PR-only with a reason, and the
result reports the tier. The zero tier is not low. Tests: gate table incl. every non-low tier, classifyRisk table,
end-to-end cases (green+medium, lookup 500/404/403, label case, containment), nine mutants flip-tested red.

Limit: the gate enforces the tier of the issue the caller names; it cannot prove it is the right issue.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SZkhi49hfeSqBp5aZJNXsM

docs/HOW_GITEA_MCP_WORKS.md

@@ -125,6 +125,13 @@ by area:
 | Search / Templates | code_search, create_project_from_template |
 | Composite | tbd_ship (trunk-based ship helper) |
 
+**`tbd_ship` merge gate (gitea-mcp#63).** A PR is squash-merged only when ALL of: the head commit's CI is fully green,
+the base branch is not review-protected, and the issue named in `issue` carries **exactly one** `risk/` label, `risk/low`.
+No `issue`, no `risk/` label, several, an unknown value (`risk/lowish`), `risk/medium`, `risk/high`, or an issue that
+cannot be read all fail closed: the PR is opened, `merged:false`, with a `reason` and the `risk` tier in the result.
+Unclassified is not low. Limit: the gate enforces the tier of the issue the caller names; it cannot prove that issue is
+the one the change belongs to, so the link is the caller's claim (the convention in local-dev rule 5 still applies).
+
 Shared tool-layer hygiene (`internal/tools/tool.go`):
 - **Alias normalization** — `repo`↔`name` and `number`↔`index` are reconciled so
   a tool works whichever spelling a caller sends (an explicit canonical wins).