Make the config file the only home for settings

With no production instance yet, there is no reason to carry two ways
of configuring the agent. Every environment variable that duplicated a
config key is gone; the environment now supplies only the secrets the
file references by ${…}, plus NISSE_CONFIG and NISSE_ENV to find the
files.

- AgentConfig loads from a file (load, from_file) or a parsed tree
  (from_tree, for tests); a missing file is an error naming the example
- The from_env constructors on LiteLLMClient, AnthropicPassthroughClient,
  GiteaClient, MatrixConfig and RoleMap are removed, with the env
  reading for max output tokens; clients take their settings from config
- The live integration tests share a committed agent config,
  tests/integration/nisse-test.yaml, aimed at test resources, and one
  conftest that loads it and builds clients. NISSE_LIVE_PLANNER_MODEL
  becomes its planner role; NISSE_CAPABILITY_MODELS stays as a per-run
  switch
- A missing secret now fails the live tests instead of skipping them
- CI passes only the three tokens
- .env.example is secrets only; spec A5 says config comes from the file

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

nisse-dev/src/nisse_dev/config.py

@@ -1,14 +1,11 @@
 """Agent configuration (spec A5: nothing hardcoded).
 
-Configuration comes from a YAML file plus the environment:
-
-- **The file carries structure.** Roles, connections, and the tuning knobs
-  (see docs/Tuning-Guide.md). It holds no secrets: a credential is written as
-  a reference, ``token: ${NISSE_LLM_TOKEN}``, and resolved from the
-  environment, so the file can be reviewed or shared without leaking.
-- **The environment wins.** Every setting that existed as an environment
-  variable still does, and overrides the file. The file is optional, so a
-  deployment or CI run configured purely from the environment works as before.
+Configuration is a YAML file: roles, connections, and the tuning knobs (see
+docs/Tuning-Guide.md). It holds no secrets. A credential is written as a
+reference, ``token: ${NISSE_LLM_TOKEN}``, and resolved from the environment,
+so the file can be reviewed, shared, or committed without leaking. The
+environment supplies those references and nothing else: every setting has
+exactly one home.
 
 Every value is collected and validated **before** anything is built, and a
 single error names every problem at once. The alternative — failing at first
@@ -31,32 +28,6 @@ from nisse_dev.matrix import MatrixConfig
 
 DEFAULT_CONFIG_FILE = "nisse-dev.yaml"
 
-# Each environment variable and the key it overrides. The names are the ones
-# the agent has always used, so existing .env files and CI keep working.
-ENV_KEYS: dict[str, str] = {
-    "NISSE_STATE_DB": "state_db",
-    "NISSE_WORKSPACE": "workspace",
-    "NISSE_PROJECT": "project",
-    "NISSE_LLM_BASE_URL": "llm.base_url",
-    "NISSE_LLM_TOKEN": "llm.token",
-    "NISSE_MAX_OUTPUT_TOKENS": "llm.max_output_tokens",
-    "NISSE_ROLE_EXECUTOR": "roles.executor",
-    "NISSE_ROLE_PLANNER": "roles.planner",
-    "NISSE_ROLE_DELEGATE": "roles.delegate",
-    "NISSE_ROLE_CONSULTANT": "roles.consultant",
-    "NISSE_MATRIX_HOMESERVER": "matrix.homeserver",
-    "NISSE_MATRIX_USER_ID": "matrix.user_id",
-    "NISSE_MATRIX_TOKEN": "matrix.token",
-    "NISSE_MATRIX_ROOM_ID": "matrix.room_id",
-    "NISSE_MATRIX_OPERATORS": "matrix.operators",
-    "NISSE_GITEA_URL": "gitea.url",
-    "NISSE_GITEA_TOKEN": "gitea.token",
-    "NISSE_GITEA_REPO": "gitea.repo",
-    "NISSE_GITEA_OPERATORS": "gitea.operators",
-    "NISSE_BASE_BRANCH": "gitea.base_branch",
-}
-KEY_ENV = {key: env for env, key in ENV_KEYS.items()}
-
 REQUIRED_KEYS = (
     "state_db",
     "workspace",
@@ -78,8 +49,6 @@ REQUIRED_KEYS = (
     "gitea.operators",
 )
 OPTIONAL_KEYS = ("llm.max_output_tokens", "gitea.base_branch")
-# Kept for callers that list what a pure-environment deployment must set.
-REQUIRED = tuple(KEY_ENV[key] for key in REQUIRED_KEYS)
 
 _REFERENCE = re.compile(r"\$\{([A-Za-z_][A-Za-z0-9_]*)\}")
 
@@ -226,11 +195,6 @@ def _read_file(path: Path, errors: list[str]) -> dict[str, Any]:
     return loaded
 
 
-def _describe(key: str) -> str:
-    env = KEY_ENV.get(key)
-    return f"{key} ({env})" if env else key
-
-
 @dataclass(frozen=True)
 class AgentConfig:
     state_db: Path
@@ -252,28 +216,39 @@ class AgentConfig:
 
     @classmethod
     def load(cls, env: Mapping[str, str] = os.environ) -> "AgentConfig":
-        """The file named by NISSE_CONFIG, or ./nisse-dev.yaml if present,
-        overlaid by the environment. Naming a file that does not exist is an
-        error; the default file is simply optional."""
-        named = env.get("NISSE_CONFIG")
-        path = Path(named or DEFAULT_CONFIG_FILE).expanduser()
-        if named and not path.is_file():
+        """The file named by NISSE_CONFIG, or ./nisse-dev.yaml."""
+        path = Path(env.get("NISSE_CONFIG") or DEFAULT_CONFIG_FILE).expanduser()
+        if not path.is_file():
             raise ConfigError(
-                f"cannot start: NISSE_CONFIG names {path}, which is missing"
+                f"cannot start: no config file at {path}; create it from "
+                "nisse-dev.example.yaml, or point NISSE_CONFIG at one"
             )
-        return cls.from_sources(env, path if path.is_file() else None)
+        return cls.from_file(path, env)
 
     @classmethod
-    def from_env(cls, env: Mapping[str, str] = os.environ) -> "AgentConfig":
-        """Environment only, with no file."""
-        return cls.from_sources(env, None)
-
-    @classmethod
-    def from_sources(
-        cls, env: Mapping[str, str], config_file: Path | None
+    def from_file(
+        cls, path: Path, env: Mapping[str, str] = os.environ
     ) -> "AgentConfig":
         errors: list[str] = []
-        tree = _read_file(config_file, errors) if config_file else {}
+        tree = _read_file(path, errors)
+        return cls._build(tree, env, errors, config_file=path)
+
+    @classmethod
+    def from_tree(
+        cls, tree: Mapping[str, Any], env: Mapping[str, str] = os.environ
+    ) -> "AgentConfig":
+        """From an already-parsed config, as the file would give it."""
+        return cls._build(tree, env, [], config_file=None)
+
+    @classmethod
+    def _build(
+        cls,
+        tree: Mapping[str, Any],
+        env: Mapping[str, str],
+        errors: list[str],
+        *,
+        config_file: Path | None,
+    ) -> "AgentConfig":
         tuning = _parse_tuning(tree.get("tuning"), errors)
         flat = _flatten(tree)
         flat.pop("tuning", None)
@@ -281,20 +256,16 @@ class AgentConfig:
         known = set(REQUIRED_KEYS) | set(OPTIONAL_KEYS)
         for key in sorted(set(flat) - known):
             errors.append(f"{key}: unknown setting")
-        overrides = {key: env[var] for var, key in ENV_KEYS.items() if var in env}
-        # A key the environment overrides is not resolved from the file, so a
-        # reference there to an unset variable is not an error.
         values = {
             key: _resolve(value, key, env, errors)
             for key, value in flat.items()
-            if key in known and key not in overrides
+            if key in known
         }
-        values.update(overrides)
 
         # Whitespace-only counts as missing: a token of spaces would pass a
         # truthiness check and fail at the first request instead.
         missing = [
-            _describe(key)
+            key
             for key in REQUIRED_KEYS
             if values.get(key) is None
             or (isinstance(values[key], str) and not values[key].strip())
@@ -309,9 +280,7 @@ class AgentConfig:
             if max_output <= 0:
                 raise ValueError
         except (TypeError, ValueError):
-            errors.append(
-                f"{_describe('llm.max_output_tokens')}: must be a positive integer"
-            )
+            errors.append("llm.max_output_tokens: must be a positive integer")
         if errors:
             raise ConfigError("cannot start: " + "; ".join(errors))
 
@@ -357,7 +326,7 @@ class AgentConfig:
         """
         workspace = self.workspace.expanduser().resolve()
         candidates = [
-            ("NISSE_STATE_DB", self.state_db),
+            ("state_db", self.state_db),
             ("NISSE_ENV", Path(env.get("NISSE_ENV", ".env"))),
         ]
         if self.config_file is not None: