nisse-review: a stop ends a review in progress; quieter repo failures

SIGTERM used to stop only new rounds: a review in progress ran on until
systemd killed it 90s later. Now the scheduler's stop sets the driver's
cancel flag, so the run ends at its next turn, and a model call in flight
is broken off (Interruptible, raising Stopped from the signal handler, only
ever inside a model call). The item goes back to ready, with nothing
drafted posted and no failure counted; replies already posted carry their
markers and are not repeated.

intake.repo_failed is logged when a repository starts failing or the reason
changes, and intake.repo_ok when it lists again, not every round.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

docs/Development-Plan.md

@@ -694,6 +694,11 @@ of earlier points, replies on threads, the round cap and its reset, `stop` and
 - **Tests:** `test_review_rounds.py`, including a no-dead-end walk over every
   position; the live smoke test adds a push and a question, and checks the
   later review at the new head.
+- **Follow-ups:** a stop (SIGTERM) ends a review in progress at its next turn,
+  or breaks off its model call (`Interruptible`, `nisse_core.models`), and the
+  PR goes back to ready with no failure counted; a repository Gitea won't
+  list is logged when that starts or changes (`intake.repo_failed`), and when
+  it ends (`intake.repo_ok`), not every round. Tests: `test_review_stop.py`.
 
 **M7.6 Deployment.** *Waits for the agent host (Phase 6).* Its image, container,
 Gitea account and secrets (R5).