feat(agent): forge state-transition tools (RIG-3331)

[rigel-mintaka]

Implements T6 of docs/designs/server/compass-forge-state-transition/design.md: the two agent tools. Stacked on #1018.

forge_transition_issue_state and forge_transition_pull_request_state, on the DL-241 single-purpose-tool pattern over the same ForgeBroker seam every existing forge tool uses.

The tool-facing parameter is pull_number, matching every other PR tool in the file, and maps to the proto's pr_number at the request boundary — agent-facing consistency over wire-name symmetry.

Schema semantics follow the record: repo required (<owner>/<name> on GitHub, team key on Linear), state is open or closed, close_reason GitHub-issues-only, workflow_state Linear-only. The PR tool takes no refinement fields — close_reason is a GitHub issue concept, and merge is a separate concern never expressed as a transition.

Tests

Broker round-trips asserting the request arm and its fields, and that the rendered result is the post-transition artifact. Plus schema-rejection tests pinning the portable state domain: merged and a Linear workflow-state name are both real forge states and neither is a legal target.

The three native-tool count tripwires in cli.test.ts move 20 → 22. That is what a tripwire is for — it caught the roster change rather than letting the tools land unnoticed.

Verified: compass-agent:test 684 pass / 0 fail; compass-agent:typecheck clean.

Ledger-impact: none — DL-342/DL-343 landed with the record's freeze in #981.

[linear-code]

RIG-3331

[github-actions]

Compass engineering docs preview: https://compass-forge-rig-3331-tools.compass-eng-docs.pages.dev

Deployed from compass-forge/rig-3331-tools at 1d46bf2.