Projects as configuration entries (M1.4, D8)

- Config: `projects: {name: entry}` with repo, base_branch, workspace,
  build_host, push credential, labels (defaults added to every issue),
  secrets by ${VAR} reference with visibility (commands | harness), and
  egress (recorded, not enforced). Every problem in every entry is
  reported at once; an inline secret, a bad visibility, a repeated repo or
  a non-slug name is an error.
- The old loop runs exactly one project (only_project) and refuses more.
- The new loop is per project: each its own clone, workspace (with its
  commands-visible secrets, redacted on return), push credential and
  milestones; intake polls every project's repository; items are scoped
  to their project for every run, publish and PR watch. Issues are named
  project#14 when there is more than one project, and a bare #14 that
  matches two is asked about. Switching projects parks the one worked on
  last (all others after a boot).
- A restatement that ends in a question is sent back to the driver, not
  posted: the e2e driver kept asking "Is this the right interpretation?",
  which a plain yes can't answer.

Tests: config entries and errors, two-project assembly, two-project loop
tests (intake, own workspaces and repos, #14 in both, do-next, label
defaults, parking across projects), the property walk over two projects
with a new own_repository_only property (an item using the first
project's repo fails 15 of 16 seeds), and the restatement check.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

tests/integration/test_end_to_end.py

@@ -74,11 +74,12 @@ def agent(
     operator = operator_gitea(live_config.gitea_url)
     base = stack.enter_context(base_branch(operator, live_config.gitea_repo, run))
     config = replace(
-        live_config,
-        base_branch=base,
+        live_config.with_project(
+            base_branch=base,
+            workspace=Path(f"/tmp/nisse-e2e-{run}/sandbox"),
+            build_host=build_host(ssh_host),
+        ),
         state_db=tmp_path / "state.db",
-        workspace=Path(f"/tmp/nisse-e2e-{run}/sandbox"),
-        build_host=build_host(ssh_host),
     )
     transport = InMemoryTransport()
     monkeypatch.setattr("nisse_dev.agent.MatrixTransport", lambda cfg: transport)