The agent as a container image (M1.5)

- Dockerfile: built with uv into /opt/nisse (installed, not editable),
  run on python:3.12-slim with openssh-client as user nisse; stateless,
  with state in a /var/lib/nisse-dev volume, config mounted at
  /etc/nisse-dev/nisse-dev.yaml, secrets as environment variables, keys
  mounted read-only. 202 MB. Its `test` stage adds the tests and their
  tools over the installed package (UV_NO_SYNC, so `uv run` never swaps
  in the source tree); the default target is the agent.
- scripts/e2e.sh --image REF runs the suite inside an image's test stage,
  on its own sshd.
- CI builds both images on every PR (nothing pushed); release.yml pushes
  gitea.dongar.net/dongar/nisse-dev:<tag> and :latest on a v* tag, with
  the REGISTRY_TOKEN secret.
- scripts/bringup.sh builds the code under test into an image and runs it
  in the systemd unit (root, $E2E mounted at its own path); `plan` prints
  what it would run; the build-VM set-aside reads the projects: config.

Checked: the image refuses to start without a config, runs as uid 10001;
one e2e test passed from the test stage (2m45s, $0).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

scripts/e2e.sh

@@ -6,6 +6,8 @@
 #
 #   scripts/e2e.sh            on the bring-up build VM (configured below)
 #   scripts/e2e.sh --local    on a throwaway local sshd instead
+#   scripts/e2e.sh --image REF   inside an image's `test` stage (Dockerfile),
+#                                on its own sshd: checks a release as built
 #
 # Uses tests/integration/nisse-test.yaml and its secrets (.env at the repo
 # root), like the integration tests. Every role runs on a local model
@@ -14,6 +16,18 @@
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
+if [ "${1:-}" = "--image" ]; then
+    image=${2:?--image needs an image reference}
+    shift 2
+    runs=${NISSE_E2E_RUNS:-/root/nisse-e2e/test-runs}
+    mkdir -p "$runs"
+    secrets=()
+    [ -f .env ] && secrets=(--env-file .env)
+    # Host networking: the suite reaches Matrix, Gitea and LiteLLM as here.
+    exec docker run --rm --network host "${secrets[@]}" \
+        -e NISSE_E2E_RUNS=/runs -v "$runs:/runs" \
+        "$image" scripts/e2e.sh --local "$@"
+fi
 if [ "${1:-}" = "--local" ]; then
     shift
 else