feat(#1888): read-before-comment guard via forge notification read-state

Rebuild on forge's own notification read-state instead of the local
seen-cursor mirror (operator-nacked: mirrors state forge owns + drifts
on restart).

- comment refuses to post when forge has an unread notification for the
  thread (someone commented since you last read it); --force overrides.
  Degrades open if the notification check itself fails.
- comments / view mark the thread's notification read (the "I've seen
  it" signal), clearing the guard for a subsequent reply.
- new crate::notify (no local file): unread_thread_id pages repo-scoped
  unread notifications (newest-first, capped) + subject-url number match;
  mark_thread_read via the new client.patch_no_content.

Pairs with the forge_notify harness change (#1895, merged) that leaves
delivered notifications unread until the agent actually reads. Covers
pr/issue comment too (they delegate to comment::run).

hive-forge/src/verbs/comment.rs

@@ -1,12 +1,21 @@
 //! `comment <number> [body sources] [repo]` — post a comment on an
 //! issue or PR.
+//!
+//! Read-before-comment guard: before posting, refuse when forge still
+//! has an unread notification for the thread — i.e. someone commented
+//! since the caller last read it. Reading the thread
+//! (`hive-forge comments <n>` / `view <n>`) marks the notification read
+//! and clears the block; `--force` overrides. The unread signal is
+//! forge's own notification read-state, not a local mirror — see
+//! `crate::notify`.
 
-use anyhow::Result;
+use anyhow::{Result, bail};
 use clap::Args as ClapArgs;
 use serde_json::json;
 
 use crate::body;
 use crate::client::Client;
+use crate::notify;
 use crate::verbs::print_json;
 
 #[derive(ClapArgs)]
@@ -19,17 +28,41 @@ pub struct Args {
     /// Read body from a file. `-` means stdin.
     #[arg(long = "body-file")]
     body_file: Option<String>,
+    /// Post even when the thread has unread activity (skips the
+    /// read-before-comment guard).
+    #[arg(long)]
+    force: bool,
 }
 
 /// # Errors
 ///
-/// Propagates any I/O error from the body input (`--body-file`,
-/// stdin), any transport error from the Forgejo REST call (network
-/// unreachable, 4xx/5xx response, token missing/invalid), and any
-/// I/O error from writing the response to stdout.
+/// Returns an error when the read-before-comment guard fires (the thread
+/// has an unread notification and `--force` was not passed), and
+/// propagates any I/O error from the body input (`--body-file`, stdin),
+/// any transport error from the Forgejo REST call (network unreachable,
+/// 4xx/5xx response, token missing/invalid), and any I/O error from
+/// writing the response to stdout.
 pub fn run(client: &Client, args: Args) -> Result<()> {
     let body = body::resolve_required(args.body.as_deref(), args.body_file.as_deref(), "comment")?;
     let repo = client.repo();
+
+    if !args.force {
+        // Degrade open: a transport failure checking notifications must
+        // not block a legitimate comment — only a *confirmed* unread
+        // thread refuses.
+        match notify::unread_thread_id(client, repo, args.number) {
+            Ok(Some(_)) => bail!(
+                "hive-forge: {repo}#{0} has unread activity — someone commented since you last \
+                 read it. Read it first (`hive-forge comments {0}`), then retry — or pass --force.",
+                args.number
+            ),
+            Ok(None) => {}
+            Err(e) => eprintln!(
+                "hive-forge: warning: could not check notifications ({e}); posting anyway"
+            ),
+        }
+    }
+
     let resp = client.post_json(
         &format!("/repos/{repo}/issues/{}/comments", args.number),
         &json!({ "body": body }),