Make the config file the only home for settings

With no production instance yet, there is no reason to carry two ways
of configuring the agent. Every environment variable that duplicated a
config key is gone; the environment now supplies only the secrets the
file references by ${…}, plus NISSE_CONFIG and NISSE_ENV to find the
files.

- AgentConfig loads from a file (load, from_file) or a parsed tree
  (from_tree, for tests); a missing file is an error naming the example
- The from_env constructors on LiteLLMClient, AnthropicPassthroughClient,
  GiteaClient, MatrixConfig and RoleMap are removed, with the env
  reading for max output tokens; clients take their settings from config
- The live integration tests share a committed agent config,
  tests/integration/nisse-test.yaml, aimed at test resources, and one
  conftest that loads it and builds clients. NISSE_LIVE_PLANNER_MODEL
  becomes its planner role; NISSE_CAPABILITY_MODELS stays as a per-run
  switch
- A missing secret now fails the live tests instead of skipping them
- CI passes only the three tokens
- .env.example is secrets only; spec A5 says config comes from the file

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

nisse-dev.example.yaml

@@ -2,44 +2,42 @@
 # NISSE_CONFIG at your copy) and edit.
 #
 # - Structure lives here. Secrets do not: write them as ${VARIABLE} references,
-#   resolved from the environment (or .env) at startup.
-# - Environment variables win. Every NISSE_* variable in .env.example
-#   overrides the key noted beside it here.
+#   resolved from the environment (or .env, see .env.example) at startup.
 # - Keep this file outside the workspace clone. Startup refuses otherwise,
 #   because the agent commits and pushes everything in the clone.
 # - Unknown keys are errors, so a misspelt knob fails at startup instead of
 #   silently doing nothing.
 
-state_db: ~/nisse-demo-workspace/state.db    # NISSE_STATE_DB
-workspace: ~/nisse-demo-workspace/project    # NISSE_WORKSPACE, the clone
-project: demo                                # NISSE_PROJECT
+state_db: ~/nisse-demo-workspace/state.db
+workspace: ~/nisse-demo-workspace/project  # the clone
+project: demo
 
 llm:                                  # A5: LiteLLM is the only LLM destination
-  base_url: http://litellm.example:4000      # NISSE_LLM_BASE_URL
+  base_url: http://litellm.example:4000
   token: ${NISSE_LLM_TOKEN}
   # Ceiling on each response. Must fit inside a local model's context window
   # alongside the prompt; see docs/Tuning-Guide.md.
-  max_output_tokens: 16384                   # NISSE_MAX_OUTPUT_TOKENS
+  max_output_tokens: 16384
 
 roles:                                # A11: role -> LiteLLM model alias
-  executor: local-fast                       # NISSE_ROLE_EXECUTOR
-  planner: claude-opus-5                     # NISSE_ROLE_PLANNER
-  delegate: claude-opus-5                    # NISSE_ROLE_DELEGATE
-  consultant: claude-opus-5                  # NISSE_ROLE_CONSULTANT
+  executor: local-fast
+  planner: claude-opus-5
+  delegate: claude-opus-5
+  consultant: claude-opus-5
 
 matrix:                               # A1
-  homeserver: https://matrix.example         # NISSE_MATRIX_HOMESERVER
-  user_id: "@nisse-dev:example"              # NISSE_MATRIX_USER_ID
+  homeserver: https://matrix.example
+  user_id: "@nisse-dev:example"
   token: ${NISSE_MATRIX_TOKEN}
-  room_id: "!roomid:example"                 # NISSE_MATRIX_ROOM_ID
-  operators: ["@you:example"]                # NISSE_MATRIX_OPERATORS (comma-separated)
+  room_id: "!roomid:example"
+  operators: ["@you:example"]
 
 gitea:                                # B2
-  url: https://gitea.example                 # NISSE_GITEA_URL
+  url: https://gitea.example
   token: ${NISSE_GITEA_TOKEN}
-  repo: owner/demo-repo                      # NISSE_GITEA_REPO
-  operators: [your-gitea-login]              # NISSE_GITEA_OPERATORS (comma-separated)
-  base_branch: main                          # NISSE_BASE_BRANCH
+  repo: owner/demo-repo
+  operators: [your-gitea-login]
+  base_branch: main
 
 # What each knob does, and how to choose a value: docs/Tuning-Guide.md.
 # These are the defaults; the section can be left out entirely. The file is