feat(demo): reset deletes the demo repositories' issues, PRs and branches

A rerun should start from nothing. DEMO_REPOS is the entire blast radius and
is deliberately explicit: a real service's issues are genuine triage records,
and clearing them to tidy a demo would destroy the evidence the system exists
to produce.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/ops/hermes_triage_demo.sh

@@ -82,43 +82,65 @@ cmd_monitor() {
   exec python3 "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/hermes_triage_monitor.py"
 }
 
-# Restores only what the demo itself creates. Real service repositories are
-# never touched: those issues are genuine triage records and deleting them to
-# tidy a demo would destroy the evidence the system exists to produce.
+# Deletes the demo repositories' issues, pull requests and repair branches so a
+# rerun starts from nothing. DEMO_REPOS is the whole blast radius and is
+# deliberately explicit: a real service's issues are genuine triage records,
+# and clearing them to tidy a demo would destroy the evidence the system
+# exists to produce.
+DEMO_REPOS="${DEMO_REPOS:-hermes-code-demo}"
+
 cmd_reset() {
   require_jenkins
   say "Reset — restoring the demo to its pre-run state"
 
   note "fixture -> healthy"
-  kubectl -n "$DEMO_NS" patch cm hermes-triage-demo-fixture \
-    --type merge -p '{"data":{"state":"healthy"}}' >/dev/null 2>&1 &&
-    note "  fixture: $(kubectl -n "$DEMO_NS" get cm hermes-triage-demo-fixture -o jsonpath='{.data.state}')" ||
+  if kubectl -n "$DEMO_NS" patch cm hermes-triage-demo-fixture \
+      --type merge -p '{"data":{"state":"healthy"}}' >/dev/null 2>&1; then
+    note "  fixture: $(kubectl -n "$DEMO_NS" get cm hermes-triage-demo-fixture -o jsonpath='{.data.state}')"
+  else
     note "  fixture patch failed (is the demo namespace present?)"
+  fi
 
   local gitea="${GITEA_URL:-https://scm.bstein.dev}"
   if [ -z "${GITEA_TOKEN:-}" ]; then
-    note "GITEA_TOKEN unset; skipping pull request and branch cleanup"
+    note "GITEA_TOKEN unset; skipping repository cleanup"
   else
-    note "closing open repair pull requests on hermes-code-demo"
-    local prs
-    prs="$(curl -s -H "Authorization: token $GITEA_TOKEN" \
-      "$gitea/api/v1/repos/bstein/hermes-code-demo/pulls?state=open" |
-      python3 -c 'import json,sys
-for p in json.load(sys.stdin):
-    print(p["number"], p["head"]["ref"])' 2>/dev/null || true)"
-    if [ -z "$prs" ]; then
-      note "  none open"
-    else
-      while read -r num ref; do
-        [ -z "$num" ] && continue
-        curl -s -o /dev/null -X PATCH -H "Authorization: token $GITEA_TOKEN" \
-          -H "Content-Type: application/json" -d '{"state":"closed"}' \
-          "$gitea/api/v1/repos/bstein/hermes-code-demo/pulls/$num"
-        curl -s -o /dev/null -X DELETE -H "Authorization: token $GITEA_TOKEN" \
-          "$gitea/api/v1/repos/bstein/hermes-code-demo/branches/$ref"
-        note "  closed #$num and deleted branch $ref"
-      done <<< "$prs"
-    fi
+    for repo in $DEMO_REPOS; do
+      note "clearing bstein/$repo (demo repository)"
+      local items
+      items="$(curl -s -H "Authorization: token $GITEA_TOKEN" \
+        "$gitea/api/v1/repos/bstein/$repo/issues?state=all&limit=100" |
+        python3 -c 'import json,sys
+for i in json.load(sys.stdin):
+    print(i["number"], "pr" if i.get("pull_request") else "issue")' 2>/dev/null || true)"
+      if [ -z "$items" ]; then
+        note "  no issues or pull requests"
+      else
+        while read -r num kind; do
+          [ -z "$num" ] && continue
+          curl -s -o /dev/null -X DELETE -H "Authorization: token $GITEA_TOKEN" \
+            "$gitea/api/v1/repos/bstein/$repo/issues/$num"
+          note "  deleted $kind #$num"
+        done <<< "$items"
+      fi
+
+      local branches
+      branches="$(curl -s -H "Authorization: token $GITEA_TOKEN" \
+        "$gitea/api/v1/repos/bstein/$repo/branches" |
+        python3 -c 'import json,sys,urllib.parse
+for b in json.load(sys.stdin):
+    if b["name"].startswith("hermes-repair/"):
+        print(urllib.parse.quote(b["name"], safe=""))' 2>/dev/null || true)"
+      if [ -z "$branches" ]; then
+        note "  no repair branches"
+      else
+        for ref in $branches; do
+          curl -s -o /dev/null -X DELETE -H "Authorization: token $GITEA_TOKEN" \
+            "$gitea/api/v1/repos/bstein/$repo/branches/$ref"
+          note "  deleted branch $(printf '%b' "${ref//%/\\x}")"
+        done
+      fi
+    done
   fi
 
   if [ -d "$CODE_REPO_DIR/.git" ]; then
@@ -127,13 +149,14 @@ for p in json.load(sys.stdin):
     if grep -q 'percent / 100' "$CODE_REPO_DIR/src/discount.py" 2>/dev/null; then
       note "  src/discount.py is correct; demo is armable"
     else
-      note "  src/discount.py still carries the seeded defect — merge or revert it before demoing"
+      note "  src/discount.py still carries the seeded defect — revert it before demoing"
     fi
   else
     note "demo repository not cloned at $CODE_REPO_DIR; skipping"
   fi
 
   say "Ready"
+  note "real service repositories were not touched"
   note "run 'preflight' next, then arm the fixture build"
 }