feat: extract reusable dev/CI tools from GRM into devx package

Port core modules (config, exceptions, i18n, api_clients, gitea_cli),
14 CI scripts, 6 dev tools, 5 molecule tools, CLI entry point, workflows,
Makefile, tests (784 tests, 100% coverage), and documentation from GRM.

The devx package is published to the Gitea PyPI registry and consumed
by GRM, infra, and other oblachno-oss projects as a pip dependency.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

tests/unit/test_notify_failure.py

@@ -0,0 +1,116 @@
+"""Unit tests for scripts/ci/notify_failure.py."""
+
+from unittest.mock import MagicMock, patch
+
+from click.testing import CliRunner
+
+from devx.ci.notify_failure import main
+from devx.gitea_cli import TeaCLIError
+
+
+class TestNotifyFailure:
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok"})
+    @patch("devx.ci.notify_failure.TeaCLI")
+    def test_creates_issue_with_tea(self, mock_tea_cls: MagicMock) -> None:
+        mock_tea = MagicMock()
+        mock_tea.list_labels.return_value = [{"id": 5, "name": "bug"}]
+        mock_tea.create_issue.return_value = {"index": 42, "title": "test"}
+        mock_tea_cls.return_value = mock_tea
+
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            [
+                "--repo",
+                "owner/repo",
+                "--run-id",
+                "123",
+                "--workflow",
+                "release",
+                "--commit",
+                "abc123def456",
+            ],
+        )
+        assert result.exit_code == 0
+        assert "issue #42" in result.output
+        mock_tea.create_issue.assert_called_once()
+        mock_tea.add_label.assert_called_once_with("owner/repo", 42, ["bug"])
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok"})
+    @patch("devx.ci.notify_failure.TeaCLI")
+    def test_tea_creates_issue_without_bug_label(self, mock_tea_cls: MagicMock) -> None:
+        mock_tea = MagicMock()
+        mock_tea.list_labels.return_value = [{"id": 1, "name": "enhancement"}]
+        mock_tea.create_issue.return_value = {"index": 43, "title": "test"}
+        mock_tea_cls.return_value = mock_tea
+
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            ["--repo", "owner/repo", "--run-id", "124", "--workflow", "publish", "--commit", "def789"],
+        )
+        assert result.exit_code == 0
+        assert "issue #43" in result.output
+        mock_tea.add_label.assert_not_called()
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok"})
+    @patch("devx.ci.notify_failure.TeaCLI")
+    def test_tea_error_raises(self, mock_tea_cls: MagicMock) -> None:
+        """When tea fails, the workflow fails — no fallback."""
+        mock_tea = MagicMock()
+        mock_tea.list_labels.side_effect = TeaCLIError("network error")
+        mock_tea.create_issue.side_effect = TeaCLIError("network error")
+        mock_tea_cls.return_value = mock_tea
+
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            ["--repo", "owner/repo", "--run-id", "125", "--workflow", "release", "--commit", "abc"],
+        )
+        assert result.exit_code != 0
+        assert "tea" in result.output.lower()
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok"})
+    @patch("devx.ci.notify_failure.TeaCLI")
+    def test_tea_list_labels_error_continues_without_labels(self, mock_tea_cls: MagicMock) -> None:
+        """If listing labels fails via tea, issue is still created without labels."""
+        mock_tea = MagicMock()
+        mock_tea.list_labels.side_effect = TeaCLIError("network error")
+        mock_tea.create_issue.return_value = {"index": 50, "title": "test"}
+        mock_tea_cls.return_value = mock_tea
+
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            ["--repo", "owner/repo", "--run-id", "128", "--workflow", "release", "--commit", "abc"],
+        )
+        assert result.exit_code == 0
+        assert "issue #50" in result.output
+
+    @patch.dict("os.environ", {"REPO_TOKEN": "tok"})
+    @patch("devx.ci.notify_failure.TeaCLI")
+    def test_tea_add_label_error_is_ignored(self, mock_tea_cls: MagicMock) -> None:
+        """If adding label fails via tea, issue is still reported as created."""
+        mock_tea = MagicMock()
+        mock_tea.list_labels.return_value = [{"id": 5, "name": "bug"}]
+        mock_tea.create_issue.return_value = {"index": 51, "title": "test"}
+        mock_tea.add_label.side_effect = TeaCLIError("permission denied")
+        mock_tea_cls.return_value = mock_tea
+
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            ["--repo", "owner/repo", "--run-id", "129", "--workflow", "release", "--commit", "abc"],
+        )
+        assert result.exit_code == 0
+        assert "issue #51" in result.output
+
+    @patch.dict("os.environ", {"REPO_TOKEN": ""}, clear=True)
+    def test_missing_token_exits(self) -> None:
+        runner = CliRunner()
+        result = runner.invoke(
+            main,
+            ["--repo", "owner/repo", "--run-id", "1", "--workflow", "release", "--commit", "abc"],
+        )
+        assert result.exit_code != 0
+        assert "REPO_TOKEN" in result.output