Make the config file the only home for settings

With no production instance yet, there is no reason to carry two ways
of configuring the agent. Every environment variable that duplicated a
config key is gone; the environment now supplies only the secrets the
file references by ${…}, plus NISSE_CONFIG and NISSE_ENV to find the
files.

- AgentConfig loads from a file (load, from_file) or a parsed tree
  (from_tree, for tests); a missing file is an error naming the example
- The from_env constructors on LiteLLMClient, AnthropicPassthroughClient,
  GiteaClient, MatrixConfig and RoleMap are removed, with the env
  reading for max output tokens; clients take their settings from config
- The live integration tests share a committed agent config,
  tests/integration/nisse-test.yaml, aimed at test resources, and one
  conftest that loads it and builds clients. NISSE_LIVE_PLANNER_MODEL
  becomes its planner role; NISSE_CAPABILITY_MODELS stays as a per-run
  switch
- A missing secret now fails the live tests instead of skipping them
- CI passes only the three tokens
- .env.example is secrets only; spec A5 says config comes from the file

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.env.example

@@ -1,64 +1,18 @@
-# Copy to .env (chmod 600). Real environment variables win over this file.
-# .env is gitignored; never commit real values.
+# Secrets only. Copy to .env (chmod 600); it is gitignored, so never commit
+# real values. Real environment variables win over this file.
 #
-# Settings can also live in a YAML file (nisse-dev.example.yaml), which keeps
-# structure and the tuning knobs; secrets stay here and are referenced from
-# the file as ${NISSE_LLM_TOKEN} and so on. Every variable below overrides the
-# matching key in that file.
+# Everything else lives in the YAML config (see nisse-dev.example.yaml),
+# which refers to these by name, e.g. `token: ${NISSE_LLM_TOKEN}`. The live
+# integration tests use the same names, from tests/integration/nisse-test.yaml.
 
-# --- LLM access (A5): the LiteLLM proxy is the single LLM destination ---
-NISSE_LLM_BASE_URL=http://litellm.example:4000
 NISSE_LLM_TOKEN=sk-your-litellm-virtual-key
-
-# --- Role mapping (A11): roles resolve to concrete model strings ---
-NISSE_ROLE_EXECUTOR=anthropic/claude-haiku-4-5-20251001
-NISSE_ROLE_PLANNER=anthropic/claude-opus-5
-NISSE_ROLE_DELEGATE=anthropic/claude-opus-5
-NISSE_ROLE_CONSULTANT=anthropic/claude-opus-5
-
-# Opt-in for the live planning test: a model the virtual key can reach that
-# holds the tool-call contract. Planning escalates unconditionally (A12), and
-# small local models do not hold the contract reliably — llama3.2 returns
-# truncated tool arguments, Haiku-class and up are solid.
-NISSE_LIVE_PLANNER_MODEL=claude-haiku-4-5
-
-# --- Matrix transport (A1), used by nisse-dev's MatrixTransport ---
-NISSE_MATRIX_HOMESERVER=https://matrix.example
-NISSE_MATRIX_USER_ID=@nisse-dev:example
 NISSE_MATRIX_TOKEN=syt_your_matrix_access_token
-NISSE_MATRIX_ROOM_ID=!roomid:example
-# Dedicated room for the live integration test; never the production room.
-NISSE_MATRIX_TEST_ROOM_ID=!testroomid:example
-NISSE_MATRIX_OPERATORS=@you:example
-
-# --- Gitea (B2): service account for branches, PRs, and comment intake ---
-NISSE_GITEA_URL=https://gitea.example
 NISSE_GITEA_TOKEN=your-scoped-service-account-token
-# Sandbox repo for live tests; never the real project repo.
-NISSE_GITEA_TEST_REPO=owner/sandbox-repo
-# Gitea logins allowed to drive the agent via PR comments (A4 per-channel
-# allowlist; a Matrix MXID and a Gitea login are different names).
-NISSE_GITEA_OPERATORS=your-gitea-login
 
-# --- Running the agent (the demo, not the tests) ---
-# The tests use NISSE_GITEA_TEST_REPO; a running agent uses these.
-#
-# Layout. NISSE_WORKSPACE is the *clone the agent works in*, not the directory
-# the agent runs from — they must not be the same place:
-#
-#   ~/nisse-demo-workspace/     deployment root, not a git repo
-#   ├── .env                    this file
-#   ├── state.db                the A2 state store
-#   └── project/                NISSE_WORKSPACE, the clone
-#
-# The agent commits its workspace with `git add -A` and pushes it, so anything
-# inside the clone reaches the project repository. A .env or state store placed
-# there would publish credentials as a side effect of the agent working
-# correctly; startup refuses to proceed if either is inside the workspace.
-NISSE_STATE_DB=~/nisse-demo-workspace/state.db
-NISSE_WORKSPACE=~/nisse-demo-workspace/project
-NISSE_PROJECT=demo
-NISSE_GITEA_REPO=owner/demo-repo
-# NISSE_BASE_BRANCH=main
-# Path to this file, if not ./.env
-# NISSE_ENV=~/nisse-demo-workspace/.env
+# Where the config file is, if not ./nisse-dev.yaml. Where this file is, if
+# not ./.env, is NISSE_ENV, which has to be set in the real environment.
+# NISSE_CONFIG=~/nisse-demo-workspace/nisse-dev.yaml
+
+# Opt-in for the capability matrix: models to measure, comma separated.
+# Spends real tokens across every model listed. See docs/Tuning-Guide.md.
+# NISSE_CAPABILITY_MODELS=local-fast,local-coder