contexts, and adopting by name: loomctl external add loom/cart cart

The config becomes kubectl-shaped — named contexts with one current, each holding a
host, its flavor and a read-only token — and a bare owner/repo resolves against it.
The point is where the details live: a host's raw-file route belongs to the host so
it sits in the context, the published directory belongs to the convention so it
sits in the code, and what is left is which repository and which document, which is
the only part a person knows.

Measured rather than assumed, because the three hosts differ. Gitea redirects its
short raw form to the resolved branch, so the lock records a branch without anybody
naming one. GitHub and GitLab accept HEAD and do not redirect, which would put a
moving ref in the lock — the hazard already recorded and nearly built anyway — so
those resolve the default branch with git ls-remote --symref first, one round trip
and no clone.

That supersedes the claim that list is the only command needing git, which is now
wrong for two of three flavors and would otherwise read as still true.

Adds loomctl config, which says which context is current and where the credential
came from without printing it, so that "my token is not being used" is answerable.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris

.loom/event-log.md

@@ -837,3 +837,41 @@ hours.**
 *The warning now names both exits, including the one we have not built. **Telling
 somebody a rule and not the way out of it is how a guardrail becomes something
 people route around.***
+
+## 2026-09-07 — measured: only gitea resolves its own short raw URL `rowan`
+
+**A lock must record a resolved URL** — *a short form follows whatever the default
+branch is at the time you ask, so a branch rename reports as a change in the
+document.* **Adopting by name means building that URL, and the three hosts do not
+behave alike:**
+
+```
+gitea    /{owner}/{repo}/raw/{path}              303 -> /raw/branch/main/{path}   resolved
+github   raw.githubusercontent.com/{o}/{r}/HEAD/{path}   200, no redirect          NOT resolved
+gitlab   /{owner}/{repo}/-/raw/HEAD/{path}               200, no redirect          NOT resolved
+```
+
+**`HEAD` works on all three and resolves on none.** *It would put a moving ref in
+the lock, which is the hazard we recorded and then nearly built.*
+
+**So gitea's redirect does the work, and the other two need the branch resolved
+first** — *`git ls-remote --symref <url> HEAD`, which is one round trip and no
+clone.*
+
+**Belief that could be shown wrong:** *that gitea keeps redirecting.* **The short
+form is a convenience, not a documented interface**, *and if it stops we resolve
+the branch the same way as everybody else.*
+
+## 2026-09-07 — supersedes "git is needed for `list` only" `rowan`
+
+**Adopting by name against github or gitlab needs `git ls-remote` to resolve the
+default branch.** *Against gitea it does not, because the redirect answers the
+same question.*
+
+**So the earlier claim — `list` is the only command that needs `git`, which makes
+`list` the seam — is now wrong for two of three flavors.** *The seam is unchanged
+in practice here, where everything is gitea, and the entry would otherwise read as
+still true.*
+
+*Recorded because the code changed in a way that quietly moved a boundary somebody
+might rely on.*