nisse-review: a stop ends a review in progress; quieter repo failures

SIGTERM used to stop only new rounds: a review in progress ran on until
systemd killed it 90s later. Now the scheduler's stop sets the driver's
cancel flag, so the run ends at its next turn, and a model call in flight
is broken off (Interruptible, raising Stopped from the signal handler, only
ever inside a model call). The item goes back to ready, with nothing
drafted posted and no failure counted; replies already posted carry their
markers and are not repeated.

intake.repo_failed is logged when a repository starts failing or the reason
changes, and intake.repo_ok when it lists again, not every round.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

docs/Architecture.md

@@ -962,7 +962,10 @@ Two agents can argue forever, so a PR's exchanges are capped.
   room, it gets one too. Until then the operator stops it on a PR by commenting
   `stop` there (a review is asked for again with `review`: a fresh one of the
   whole PR, with the round count reset), and stops it entirely by stopping its
-  container. A command is an operator's whole top-level comment, acknowledged
+  container. Stopping it ends a review in progress at once: at its next turn,
+  or by breaking off the model call it is waiting on. Nothing drafted is
+  posted, and the PR is reviewed again when it starts, with no failure
+  counted. A command is an operator's whole top-level comment, acknowledged
   with a reaction rather than a comment the PR's author would have to answer.
 - **Its own identity** (L12): a Gitea account (`nisse-review`) with read access to
   the repositories it reviews, its own token and LiteLLM key, and its own