M7.1: extract nisse-core

What isn't the dev agent's moves to nisse-core, unchanged in behaviour,
with its tests: canonical, render, render_anthropic, llm, catalog, probe,
context, views, state, reconcile, worker, cancel, dump, transport, matrix,
execution, testing, vault, memory, oplog, envfile and gitea (whole).

- nisse_core.state.StateStore holds the tables every agent has; an
  agent's subclass adds its tables (version, migrations), roles and
  views. nisse_dev.state.StateStore adds the build VM blocks (v5).
- views.project takes what each role is shown, rather than a fixed table.
- Vault takes the agent's name (agent=), for provenance.
- A test that nisse_core never imports an agent.
- The loop, config, git, delegation, expert, tools and evals stay in
  nisse-dev until nisse-ops has a loop to share.

Docs: the Development Plan marks M7.1 done and notes that Phase 6 waits on
the agent host and Terraform; Architecture Part L names the package.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

docs/Architecture.md

@@ -131,7 +131,13 @@ naming a milestone (D4).
 
 ## Part L — The shared library (`nisse-core`)
 
-Everything in this part is used by every agent.
+Everything in this part is used by every agent. In code it is the `nisse_core`
+package: the transcript (L7) and its renderers, the LLM client and model catalog
+(L9), context fitting and per-role views (L6), the state store and reconciliation
+(L8), transports (L5), SSH execution (L13), the vault and memory (L10, L6.4),
+logging and secrets loading (L12), and the Gitea client (L1). An agent extends
+the store with its own tables, roles and views; the loop is still `nisse-dev`'s
+until a second agent shares it.
 
 ### L1. The work model