Make the config file the only home for settings

With no production instance yet, there is no reason to carry two ways
of configuring the agent. Every environment variable that duplicated a
config key is gone; the environment now supplies only the secrets the
file references by ${…}, plus NISSE_CONFIG and NISSE_ENV to find the
files.

- AgentConfig loads from a file (load, from_file) or a parsed tree
  (from_tree, for tests); a missing file is an error naming the example
- The from_env constructors on LiteLLMClient, AnthropicPassthroughClient,
  GiteaClient, MatrixConfig and RoleMap are removed, with the env
  reading for max output tokens; clients take their settings from config
- The live integration tests share a committed agent config,
  tests/integration/nisse-test.yaml, aimed at test resources, and one
  conftest that loads it and builds clients. NISSE_LIVE_PLANNER_MODEL
  becomes its planner role; NISSE_CAPABILITY_MODELS stays as a per-run
  switch
- A missing secret now fails the live tests instead of skipping them
- CI passes only the three tokens
- .env.example is secrets only; spec A5 says config comes from the file

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

nisse-dev/src/nisse_dev/llm.py

@@ -2,18 +2,16 @@
 
 One client interface, present from the first real LLM call. All traffic goes
 to the LiteLLM proxy — the VM's single LLM destination; the agent holds one
-LiteLLM token and no vendor credentials. Config comes from the environment
-(``NISSE_LLM_BASE_URL``, ``NISSE_LLM_TOKEN``), nothing hardcoded.
+LiteLLM token and no vendor credentials. The base URL and token come from the
+agent's config (nisse_dev.config), nothing hardcoded.
 
 Model identity is expressed as roles (A11), resolved to concrete model strings
-from env config; the resolved mapping is pinned at task start so a mid-task
+from config; the resolved mapping is pinned at task start so a mid-task
 config change cannot split a task across two planners.
 """
 
 import json
-import os
 import time
-from collections.abc import Mapping
 from dataclasses import asdict, dataclass
 from typing import Any, ClassVar, Protocol
 
@@ -49,11 +47,6 @@ RATE_LIMIT_RETRY_S = 20.0
 DEFAULT_MAX_OUTPUT_TOKENS = 16384
 
 
-def max_output_tokens(env: Mapping[str, str] = os.environ) -> int:
-    raw = env.get("NISSE_MAX_OUTPUT_TOKENS")
-    return int(raw) if raw else DEFAULT_MAX_OUTPUT_TOKENS
-
-
 class UpstreamUnavailable(LLMError):
     """The proxy or provider could not be reached, or refused for reasons
     unrelated to what was asked: a network blip, a timeout, a 5xx, a rate
@@ -113,22 +106,10 @@ class RoleMap:
     delegate: str
     consultant: str
 
-    _ENV_VARS: ClassVar[dict[str, str]] = {
-        "executor": "NISSE_ROLE_EXECUTOR",
-        "planner": "NISSE_ROLE_PLANNER",
-        "delegate": "NISSE_ROLE_DELEGATE",
-        "consultant": "NISSE_ROLE_CONSULTANT",
-    }
-
-    @classmethod
-    def from_env(cls, env: Mapping[str, str] = os.environ) -> "RoleMap":
-        missing = [var for var in cls._ENV_VARS.values() if not env.get(var)]
-        if missing:
-            raise LLMError(f"role mapping incomplete; set: {', '.join(missing)}")
-        return cls(**{role: env[var] for role, var in cls._ENV_VARS.items()})
+    ROLES: ClassVar[tuple[str, ...]] = ("executor", "planner", "delegate", "consultant")
 
     def resolve(self, role: str) -> str:
-        if role not in self._ENV_VARS:
+        if role not in self.ROLES:
             raise LLMError(f"unknown role: {role!r}")
         return str(getattr(self, role))
 
@@ -156,20 +137,12 @@ class LiteLLMClient:
         )
         self._renderer = OpenAIChatRenderer()
         self._sleep = sleep
-        self._max_tokens = max_tokens or max_output_tokens()
+        self._max_tokens = max_tokens or DEFAULT_MAX_OUTPUT_TOKENS
         # Set after each call so a caller can meter itself (A13 caps);
         # a side channel rather than a return value, so the LLMClient
         # protocol stays the same for every implementation.
         self.last_usage: dict[str, int] = {}
 
-    @classmethod
-    def from_env(cls, env: Mapping[str, str] = os.environ) -> "LiteLLMClient":
-        base_url = env.get("NISSE_LLM_BASE_URL")
-        token = env.get("NISSE_LLM_TOKEN")
-        if not base_url or not token:
-            raise LLMError("set NISSE_LLM_BASE_URL and NISSE_LLM_TOKEN")
-        return cls(base_url, token)
-
     def complete(
         self,
         events: list[StoredEvent],
@@ -203,7 +176,7 @@ class LiteLLMClient:
         if choice.get("finish_reason") == "length":
             raise TruncatedResponse(
                 f"{requested_model} hit its output limit mid-answer; "
-                "raise NISSE_MAX_OUTPUT_TOKENS"
+                "raise llm.max_output_tokens"
             )
         produced_by = data.get("model") or requested_model
         usage = data.get("usage") or {}
@@ -275,20 +248,10 @@ class AnthropicPassthroughClient:
             transport=transport,
         )
         self._renderer = AnthropicMessagesRenderer()
-        self._max_tokens = max_tokens or max_output_tokens()
+        self._max_tokens = max_tokens or DEFAULT_MAX_OUTPUT_TOKENS
         self._sleep = sleep
         self.last_usage: dict[str, int] = {}
 
-    @classmethod
-    def from_env(
-        cls, env: Mapping[str, str] = os.environ
-    ) -> "AnthropicPassthroughClient":
-        base_url = env.get("NISSE_LLM_BASE_URL")
-        token = env.get("NISSE_LLM_TOKEN")
-        if not base_url or not token:
-            raise LLMError("set NISSE_LLM_BASE_URL and NISSE_LLM_TOKEN")
-        return cls(base_url, token)
-
     def complete(
         self,
         events: list[StoredEvent],
@@ -315,7 +278,7 @@ class AnthropicPassthroughClient:
         if data.get("stop_reason") == "max_tokens":
             raise TruncatedResponse(
                 f"{requested_model} hit the output limit of {self._max_tokens} "
-                f"tokens mid-answer; raise NISSE_MAX_OUTPUT_TOKENS"
+                f"tokens mid-answer; raise llm.max_output_tokens"
             )
         content = data.get("content")
         if not isinstance(content, list):