Make the config file the only home for settings

With no production instance yet, there is no reason to carry two ways
of configuring the agent. Every environment variable that duplicated a
config key is gone; the environment now supplies only the secrets the
file references by ${…}, plus NISSE_CONFIG and NISSE_ENV to find the
files.

- AgentConfig loads from a file (load, from_file) or a parsed tree
  (from_tree, for tests); a missing file is an error naming the example
- The from_env constructors on LiteLLMClient, AnthropicPassthroughClient,
  GiteaClient, MatrixConfig and RoleMap are removed, with the env
  reading for max output tokens; clients take their settings from config
- The live integration tests share a committed agent config,
  tests/integration/nisse-test.yaml, aimed at test resources, and one
  conftest that loads it and builds clients. NISSE_LIVE_PLANNER_MODEL
  becomes its planner role; NISSE_CAPABILITY_MODELS stays as a per-run
  switch
- A missing secret now fails the live tests instead of skipping them
- CI passes only the three tokens
- .env.example is secrets only; spec A5 says config comes from the file

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

nisse-dev/tests/test_agent_build.py

@@ -8,7 +8,7 @@ from typing import Any
 
 import httpx
 import pytest
-from test_config import COMPLETE
+from test_config import SECRETS, tree
 
 from nisse_dev.agent import build_agent, discover_models, prepare_workspace
 from nisse_dev.catalog import ModelCatalog, UnknownModel
@@ -34,14 +34,15 @@ TEST_CATALOG = ModelCatalog.from_payload(
 )
 
 
-def config_for(tmp_path: Path, **overrides: str) -> AgentConfig:
-    env = {
-        **COMPLETE,
-        "NISSE_STATE_DB": str(tmp_path / "state.db"),
-        "NISSE_WORKSPACE": str(tmp_path / "work"),
-        **overrides,
-    }
-    return AgentConfig.from_env(env)
+def config_for(tmp_path: Path, **changes: str) -> AgentConfig:
+    return AgentConfig.from_tree(
+        tree(
+            state_db=str(tmp_path / "state.db"),
+            workspace=str(tmp_path / "work"),
+            **changes,
+        ),
+        SECRETS,
+    )
 
 
 @pytest.fixture
@@ -59,7 +60,7 @@ def origin(tmp_path: Path) -> Path:
 
 
 def test_workspace_is_cloned_when_absent(tmp_path: Path, origin: Path) -> None:
-    config = config_for(tmp_path, NISSE_GITEA_URL=f"file://{origin}")
+    config = config_for(tmp_path, gitea__url=f"file://{origin}")
     # authenticated_url would mangle a file:// remote, so clone directly.
     GitRepo(tmp_path).clone(str(origin), config.workspace)
     repo = prepare_workspace(config, "nisse-dev-testing")
@@ -206,7 +207,7 @@ def test_httpx_clients_are_not_shared_between_routes(
 def test_a_typod_role_refuses_to_boot(tmp_path: Path, monkeypatch) -> None:
     # Misconfiguration should cost a second at startup, not be discovered ten
     # minutes into a milestone.
-    config = config_for(tmp_path, NISSE_ROLE_PLANNER="clause-opus-5")
+    config = config_for(tmp_path, roles__planner="clause-opus-5")
     monkeypatch.setattr(
         "nisse_dev.agent.ModelCatalog.discover",
         classmethod(lambda cls, *a, **kw: TEST_CATALOG),
@@ -220,7 +221,7 @@ def test_a_role_this_key_cannot_reach_refuses_to_boot(
 ) -> None:
     # /model/info is scoped per key, so the same check catches a role pointed
     # at a real model that this token has no access to.
-    config = config_for(tmp_path, NISSE_ROLE_EXECUTOR="local-fast")
+    config = config_for(tmp_path, roles__executor="local-fast")
     monkeypatch.setattr(
         "nisse_dev.agent.ModelCatalog.discover",
         classmethod(lambda cls, *a, **kw: TEST_CATALOG),