Make the config file the only home for settings

With no production instance yet, there is no reason to carry two ways
of configuring the agent. Every environment variable that duplicated a
config key is gone; the environment now supplies only the secrets the
file references by ${…}, plus NISSE_CONFIG and NISSE_ENV to find the
files.

- AgentConfig loads from a file (load, from_file) or a parsed tree
  (from_tree, for tests); a missing file is an error naming the example
- The from_env constructors on LiteLLMClient, AnthropicPassthroughClient,
  GiteaClient, MatrixConfig and RoleMap are removed, with the env
  reading for max output tokens; clients take their settings from config
- The live integration tests share a committed agent config,
  tests/integration/nisse-test.yaml, aimed at test resources, and one
  conftest that loads it and builds clients. NISSE_LIVE_PLANNER_MODEL
  becomes its planner role; NISSE_CAPABILITY_MODELS stays as a per-run
  switch
- A missing secret now fails the live tests instead of skipping them
- CI passes only the three tokens
- .env.example is secrets only; spec A5 says config comes from the file

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/integration/test_milestone_live.py

@@ -2,12 +2,11 @@
 approve through the gate, then let the executor role actually create and test
 a file on disk.
 
-Gated on NISSE_LIVE_PLANNER_MODEL like the planning test — it needs a model
-that holds the tool-call contract on both ends.
+Uses the test config's planner model for every role: it needs a model that
+holds the tool-call contract on both ends.
 """
 
 import io
-import os
 from pathlib import Path
 
 import pytest
@@ -19,7 +18,6 @@ from nisse_dev.control import (
     EXECUTING,
     Orchestrator,
 )
-from nisse_dev.envfile import load_env_file
 from nisse_dev.executor import LLMExecutor
 from nisse_dev.llm import LiteLLMClient, RoleMap
 from nisse_dev.oplog import OpLog
@@ -28,17 +26,7 @@ from nisse_dev.state import StateStore
 from nisse_dev.tools import Workspace
 from nisse_dev.transport import InMemoryTransport
 
-load_env_file(Path(__file__).resolve().parents[2] / ".env")
-
-SENTINEL = "NISSE_LIVE_PLANNER_MODEL"
-
-pytestmark = [
-    pytest.mark.integration,
-    pytest.mark.skipif(
-        not os.environ.get(SENTINEL),
-        reason=f"no live planner route configured ({SENTINEL} unset)",
-    ),
-]
+pytestmark = pytest.mark.integration
 
 
 def _drive_to_execution(
@@ -67,16 +55,14 @@ def _drive_to_execution(
     )
 
 
-def test_plan_approve_execute_produces_a_real_file(tmp_path: Path) -> None:
-    assert os.environ.get("NISSE_LLM_TOKEN"), (
-        f"{SENTINEL} is set, so the live path is expected to work, "
-        "but NISSE_LLM_TOKEN is missing"
-    )
+def test_plan_approve_execute_produces_a_real_file(
+    tmp_path: Path, litellm: LiteLLMClient, live_model: str
+) -> None:
     # Both roles use the capable model here: the point is the whole gated
     # loop over a real proxy, not local-model competence (measured separately).
-    model = os.environ[SENTINEL]
+    model = live_model
     roles = RoleMap(executor=model, planner=model, delegate=model, consultant=model)
-    client = LiteLLMClient.from_env()
+    client = litellm
     store = StateStore(tmp_path / "state.db", oplog=OpLog("nisse-dev", io.StringIO()))
     workspace = Workspace(tmp_path / "work", timeout_s=60)
     transport = InMemoryTransport()