docs: strike propose-work from "Still to build" — it is built

GITEA-SETUP.md listed `propose-work` as unbuilt, and this PR builds it without
touching that list, so merging would leave the doc describing a tool as missing
that exists. Strike it the way `gitea-verify` already is: say what was built,
then say what is still missing — here, an end-to-end run, which only the agent
box can do because only it holds a token that can make the POSTs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/agents/GITEA-SETUP.md

@@ -363,10 +363,12 @@ docker/port/sylph-port
 
 Not blockers for Phase 7, but the workflow is not finished without them:
 
-* **`propose-work`**, superseding `push-work` — push the branch *and* open the PR
-  with `Closes #N` *and* set the label, in one step. Today `push-work` does the
-  first third; the other two thirds being manual is how they get skipped. Its
-  existing refusals stay: no `main`, no force-push.
+* ~~**`propose-work`**~~ — done, as `docker/{decoder,port}/bin/propose-work`:
+  pushes through `push-work` (so its refusals stay in one place — no `main`, no
+  force-push), opens the PR with `Closes #N` taken from the branch name, and moves
+  the issue to `state/needs-human`. What is still missing is an *end-to-end* run:
+  everything before the network calls is exercised, the `POST`s are not, because
+  only the agent box holds a token that can make them. Its first real use is its test.
 * **an attachment uploader** — the MCP exposes `attachment_read` only, so putting
   a screenshot on an issue needs a direct `POST /repos/{owner}/{repo}/issues/{index}/assets`.
 * ~~**`gitea-verify`**~~ — done, as `tools/gitea-protect --verify`: asserts every