feat: repo delete - remove repo, move bare repo to trash

gitctl repo delete <name> removes a repo from all three places it lives,
the inverse of repo create:
- gitolite stanza via remove_stanza (inverse of add_stanza), committed
  and pushed FIRST so gitolite stops serving the repo before its bytes
  move.
- cgit block via the new delete-repo helper verb (remove_repo_block,
  inverse of insert_repo_block), backed up and synced.
- the bare repo is MOVED to TRASH_DIR (/var/lib/gitolite3/trash,
  timestamped) with a .trashinfo breadcrumb, not rm, so it is
  recoverable. A realpath check keeps the move one level under REPO_BASE.

Always confirms; the global -y is deliberately not honored (cmd_delete
never reads a.yes). Idempotent: a piece already gone is skipped.
Partial failure is resumable by re-running, like create. Both inverse
functions are pinned by add/insert-then-remove round-trip self-tests
plus middle/last/missing cases; trash_repo and do_delete_repo run on
temp dirs. Verified live: create then delete round-trips against the
real gitolite.conf, bare repo lands in the trash dir intact.

Helper changed: redeploy gitctl-helper to the server.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 7 insertions, 0 deletions

diff --git a/README.md b/README.md
index 43f852b..cc25bb5 100644
--- a/README.md
+++ b/README.md
@@ -172,6 +172,7 @@ gitctl repo create publisher --section SlackBuilds --desc "..."
 gitctl repo list
 gitctl repo desc publisher "a new description"
 gitctl repo add-remote publisher --remote-name origin
+gitctl repo delete publisher
 gitctl sync
 ```
 
@@ -197,6 +198,12 @@ for the SSH key, so it is not fully unattended.
   private repos show too. A `VIS` column marks each `PUB` (present in cgitrc) or
   `PRIV`; on a terminal public rows are green and private dim. The description
   comes from each repo's `description` file, truncated to 60 chars.
+- `repo delete` removes a repo from all three places it lives: the gitolite
+  stanza (committed and pushed first), the cgit block, and the bare repo, which
+  is MOVED to the server's trash dir (`/var/lib/gitolite3/trash`,
+  timestamped) rather than removed, so it is recoverable. It ALWAYS asks for
+  confirmation; the global `-y` does not bypass it. Idempotent: a piece already
+  gone is skipped. Prune the trash dir by hand (or a later tool) when sure.
 - `--desc` never writes cgit `repo.desc=` directly. It writes the bare repo's
   `description` file and runs sync, the single writer.
 - Every operation is idempotent and safe to re-run.