Make the config file the only home for settings

With no production instance yet, there is no reason to carry two ways
of configuring the agent. Every environment variable that duplicated a
config key is gone; the environment now supplies only the secrets the
file references by ${…}, plus NISSE_CONFIG and NISSE_ENV to find the
files.

- AgentConfig loads from a file (load, from_file) or a parsed tree
  (from_tree, for tests); a missing file is an error naming the example
- The from_env constructors on LiteLLMClient, AnthropicPassthroughClient,
  GiteaClient, MatrixConfig and RoleMap are removed, with the env
  reading for max output tokens; clients take their settings from config
- The live integration tests share a committed agent config,
  tests/integration/nisse-test.yaml, aimed at test resources, and one
  conftest that loads it and builds clients. NISSE_LIVE_PLANNER_MODEL
  becomes its planner role; NISSE_CAPABILITY_MODELS stays as a per-run
  switch
- A missing secret now fails the live tests instead of skipping them
- CI passes only the three tokens
- .env.example is secrets only; spec A5 says config comes from the file

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

nisse-dev/tests/test_llm.py

@@ -21,7 +21,6 @@ from nisse_dev.llm import (
     RoleMap,
     TruncatedResponse,
     UpstreamUnavailable,
-    max_output_tokens,
 )
 
 EVENTS = [StoredEvent(id=1, ts="t", event=UserMessage(text="hi", source="m:1"))]
@@ -165,16 +164,16 @@ def test_malformed_response_raises_llm_error() -> None:
         client.complete(EVENTS, tools=None, model="local/qwen")
 
 
-ROLE_ENV = {
-    "NISSE_ROLE_EXECUTOR": "local/qwen",
-    "NISSE_ROLE_PLANNER": "anthropic/claude-opus-5",
-    "NISSE_ROLE_DELEGATE": "anthropic/claude-opus-5",
-    "NISSE_ROLE_CONSULTANT": "anthropic/claude-opus-5",
-}
+ROLES = RoleMap(
+    executor="local/qwen",
+    planner="anthropic/claude-opus-5",
+    delegate="anthropic/claude-opus-5",
+    consultant="anthropic/claude-opus-5",
+)
 
 
 def test_role_map_resolves_and_pins() -> None:
-    roles = RoleMap.from_env(ROLE_ENV)
+    roles = ROLES
     assert roles.resolve("executor") == "local/qwen"
     assert roles.pinned() == {
         "executor": "local/qwen",
@@ -184,19 +183,9 @@ def test_role_map_resolves_and_pins() -> None:
     }
 
 
-def test_role_map_missing_env_raises() -> None:
-    with pytest.raises(LLMError, match="NISSE_ROLE_PLANNER"):
-        RoleMap.from_env({"NISSE_ROLE_EXECUTOR": "local/qwen"})
-
-
 def test_unknown_role_raises() -> None:
     with pytest.raises(LLMError, match="unknown role"):
-        RoleMap.from_env(ROLE_ENV).resolve("boss")
-
-
-def test_client_from_env_requires_config() -> None:
-    with pytest.raises(LLMError, match="NISSE_LLM_BASE_URL"):
-        LiteLLMClient.from_env({})
+        ROLES.resolve("boss")
 
 
 def test_load_env_file(tmp_path: Path) -> None:
@@ -306,12 +295,11 @@ def test_a_complete_answer_is_not_mistaken_for_truncation() -> None:
     assert call.arguments["content"] == "a real plan"
 
 
-def test_output_ceiling_is_configurable_and_generous_by_default() -> None:
+def test_output_ceiling_is_generous_by_default() -> None:
     # Output is billed by what is produced, so a low ceiling buys nothing and
-    # costs silent truncation.
+    # costs silent truncation. The configured value is tested in test_config.
     assert DEFAULT_MAX_OUTPUT_TOKENS >= 8192
-    assert max_output_tokens({}) == DEFAULT_MAX_OUTPUT_TOKENS
-    assert max_output_tokens({"NISSE_MAX_OUTPUT_TOKENS": "2048"}) == 2048
+    assert LiteLLMClient("http://x", "t")._max_tokens == DEFAULT_MAX_OUTPUT_TOKENS
 
 
 def test_truncation_is_an_llm_error_so_callers_already_handle_it() -> None: