The agent as a container image (M1.5)

- Dockerfile: built with uv into /opt/nisse (installed, not editable),
  run on python:3.12-slim with openssh-client as user nisse; stateless,
  with state in a /var/lib/nisse-dev volume, config mounted at
  /etc/nisse-dev/nisse-dev.yaml, secrets as environment variables, keys
  mounted read-only. 202 MB. Its `test` stage adds the tests and their
  tools over the installed package (UV_NO_SYNC, so `uv run` never swaps
  in the source tree); the default target is the agent.
- scripts/e2e.sh --image REF runs the suite inside an image's test stage,
  on its own sshd.
- CI builds both images on every PR (nothing pushed); release.yml pushes
  gitea.dongar.net/dongar/nisse-dev:<tag> and :latest on a v* tag, with
  the REGISTRY_TOKEN secret.
- scripts/bringup.sh builds the code under test into an image and runs it
  in the systemd unit (root, $E2E mounted at its own path); `plan` prints
  what it would run; the build-VM set-aside reads the projects: config.

Checked: the image refuses to start without a config, runs as uid 10001;
one e2e test passed from the test stage (2m45s, $0).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

docs/Development-Plan.md

@@ -271,11 +271,20 @@ in prose, asking mid-work (L5, #42, #77).
 - Deferred: config reload without a restart (with M2.5's entry step if wanted);
   the trust dial's configuration (M3.3).
 
-**M1.5 The agent as a container image.** *Pre-approved.*
+**M1.5 The agent as a container image.** *Pre-approved.* **Built** (this PR);
+accepted once a tag's image passes the e2e suite.
 - A Dockerfile for `nisse-dev`, stateless with a volume for state; a Gitea Actions
   workflow that builds it and pushes to Gitea's registry on each release tag (X4).
 - `bringup.sh` runs the image instead of a venv.
 - Acceptance: a tagged release produces an image; the end-to-end test runs from it.
+- The image runs as its own user; state in `/var/lib/nisse-dev`, configuration
+  mounted at `/etc/nisse-dev/nisse-dev.yaml`, secrets as environment variables,
+  keys mounted read-only. Its `test` stage carries the tests over the installed
+  package, for `scripts/e2e.sh --image REF`. CI builds both on every PR;
+  `release.yml` pushes `gitea.dongar.net/dongar/nisse-dev:<tag>` and `:latest`
+  (`REGISTRY_TOKEN`).
+- The live bring-up's switch to the image waits for the next live test (it needs
+  its own test repository too); `bringup.sh plan` shows what it will run.
 
 **M2.8 Switch over.** *Pre-approved, after acceptance.* `nisse-dev` runs the new
 loop; `control.py`, its tests and `orchestrator.qnt` are removed.