M3.2: the action classifier

What the fast path calls unknown is judged by an independent model call
on the item's classifier role (L4), before it runs.

- nisse_dev.loop.classifier: it sees the action and the agreed scope
  (project, repository, issue number, the restatement the operator said
  go to), built in code; never the transcript, the issue's text, tool
  output or the driver's reasoning. Its verdict is a tool call: safe
  runs; in_scope runs and is reported in the thread; needs_discussion
  asks, as a dangerous action does. An error, no verdict or an unknown
  one fails closed. Verdicts are cached per item, agreed revision and
  action. A helper is refused what needs discussion.
- action_verdict gains source, model and the classifier's exact input;
  details shows the source. An allow after the classifier asked is an
  override. scripts/classifier-evals.py exports the judgements from a
  store, read-only; tests/integration/classifier_cases.yaml is the seed
  set, run per model with --capability-models.
- The fast path's delete rule: deleting on the build VM is contained;
  only what breaks the host (system and home directories) stays
  dangerous, since in tests the build VM is the test machine.
- The classifier role is the local model in the example config.
- The property walk gains a classifier answering at random, junk and
  failures included; dangerous_only_when_allowed now covers its
  verdicts (checked against a mutant that runs them all).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/src/nisse_dev/loop/build.py

@@ -18,6 +18,7 @@ from nisse_dev.git import GitRepo, HTTPSToken, PushCredential, SSHKey
 from nisse_dev.gitea import GiteaClient
 from nisse_dev.llm import AnthropicPassthroughClient, LiteLLMClient
 from nisse_dev.loop.agent import LoopAgent, Project
+from nisse_dev.loop.classifier import ActionClassifier
 from nisse_dev.loop.driver import Driver
 from nisse_dev.loop.help import Helpers
 from nisse_dev.loop.milestones import Milestones
@@ -309,6 +310,12 @@ def build_loop_agent(
         roles=config.roles.pinned(),
         # The classifier role reads plain-language go-aheads (L5, L9).
         reader=GoAheadReader(normalized, config.roles.resolve("classifier")),
+        # L4: what the fast path doesn't know, judged on the classifier role.
+        classifier=ActionClassifier(
+            normalized,
+            config.roles.resolve("classifier"),
+            backing=lambda model: catalog.facts(model).backing,
+        ),
         helpers=helpers,
         reload=lambda known: [
             project_runtime(config, entry, store, gitea, account)