M3.2: the action classifier

What the fast path calls unknown is judged by an independent model call
on the item's classifier role (L4), before it runs.

- nisse_dev.loop.classifier: it sees the action and the agreed scope
  (project, repository, issue number, the restatement the operator said
  go to), built in code; never the transcript, the issue's text, tool
  output or the driver's reasoning. Its verdict is a tool call: safe
  runs; in_scope runs and is reported in the thread; needs_discussion
  asks, as a dangerous action does. An error, no verdict or an unknown
  one fails closed. Verdicts are cached per item, agreed revision and
  action. A helper is refused what needs discussion.
- action_verdict gains source, model and the classifier's exact input;
  details shows the source. An allow after the classifier asked is an
  override. scripts/classifier-evals.py exports the judgements from a
  store, read-only; tests/integration/classifier_cases.yaml is the seed
  set, run per model with --capability-models.
- The fast path's delete rule: deleting on the build VM is contained;
  only what breaks the host (system and home directories) stays
  dangerous, since in tests the build VM is the test machine.
- The classifier role is the local model in the example config.
- The property walk gains a classifier answering at random, junk and
  failures included; dangerous_only_when_allowed now covers its
  verdicts (checked against a mutant that runs them all).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev.example.yaml

@@ -45,7 +45,9 @@ roles:                                # L9: role -> LiteLLM model alias
   driver: claude-opus-5-5       # drives the loop: talks, restates, works
   helper: claude-opus-5-5       # takes over what the driver got stuck on
   expert: claude-haiku-4-5      # one question at a time, no tools: cheap is enough
-  # classifier: claude-haiku-4-5  # reads go-aheads (later: actions, L4); unset, expert's
+  # Reads go-aheads and judges actions the fast path doesn't know (L4); unset,
+  # the expert's. It never sees the transcript, so the driver's model is fine.
+  classifier: qwen3.8-27b
 
 # Capability profiles (L9), from benchmarks: what one role is told about
 # another (never a model's name). Optional; a model without one is briefed as