Make the config file the only home for settings

With no production instance yet, there is no reason to carry two ways
of configuring the agent. Every environment variable that duplicated a
config key is gone; the environment now supplies only the secrets the
file references by ${…}, plus NISSE_CONFIG and NISSE_ENV to find the
files.

- AgentConfig loads from a file (load, from_file) or a parsed tree
  (from_tree, for tests); a missing file is an error naming the example
- The from_env constructors on LiteLLMClient, AnthropicPassthroughClient,
  GiteaClient, MatrixConfig and RoleMap are removed, with the env
  reading for max output tokens; clients take their settings from config
- The live integration tests share a committed agent config,
  tests/integration/nisse-test.yaml, aimed at test resources, and one
  conftest that loads it and builds clients. NISSE_LIVE_PLANNER_MODEL
  becomes its planner role; NISSE_CAPABILITY_MODELS stays as a per-run
  switch
- A missing secret now fails the live tests instead of skipping them
- CI passes only the three tokens
- .env.example is secrets only; spec A5 says config comes from the file

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/integration/test_passthrough_live.py

@@ -6,30 +6,19 @@ passthrough rather than being flattened by the proxy.
 """
 
 import io
-import os
 from pathlib import Path
 
 import httpx
 import pytest
 
 from nisse_dev.canonical import AssistantText, ToolCall, ToolResult, UserMessage
-from nisse_dev.envfile import load_env_file
+from nisse_dev.config import AgentConfig
 from nisse_dev.llm import AnthropicPassthroughClient
 from nisse_dev.oplog import OpLog
 from nisse_dev.state import StateStore
 from nisse_dev.tools import EXECUTOR_TOOLS
 
-load_env_file(Path(__file__).resolve().parents[2] / ".env")
-
-SENTINEL = "NISSE_LIVE_PLANNER_MODEL"
-
-pytestmark = [
-    pytest.mark.integration,
-    pytest.mark.skipif(
-        not os.environ.get(SENTINEL),
-        reason=f"no live frontier route configured ({SENTINEL} unset)",
-    ),
-]
+pytestmark = pytest.mark.integration
 
 
 def store_with(tmp_path: Path, *events) -> StateStore:
@@ -39,18 +28,22 @@ def store_with(tmp_path: Path, *events) -> StateStore:
     return store
 
 
-def test_passthrough_completes_a_plain_turn(tmp_path: Path) -> None:
+def test_passthrough_completes_a_plain_turn(
+    tmp_path: Path, passthrough: AnthropicPassthroughClient, live_model: str
+) -> None:
     store = store_with(
         tmp_path, UserMessage(text="Reply with exactly: pong", source="live")
     )
-    result = AnthropicPassthroughClient.from_env().complete(
-        store.read_events(), None, os.environ[SENTINEL], system="Be terse."
+    result = passthrough.complete(
+        store.read_events(), None, live_model, system="Be terse."
     )
     texts = [e.text for e in result if isinstance(e, AssistantText)]
     assert texts and "pong" in texts[0].lower()
 
 
-def test_passthrough_round_trips_a_tool_call(tmp_path: Path) -> None:
+def test_passthrough_round_trips_a_tool_call(
+    tmp_path: Path, passthrough: AnthropicPassthroughClient, live_model: str
+) -> None:
     store = store_with(
         tmp_path,
         UserMessage(
@@ -58,11 +51,11 @@ def test_passthrough_round_trips_a_tool_call(tmp_path: Path) -> None:
             source="live",
         ),
     )
-    client = AnthropicPassthroughClient.from_env()
+    client = passthrough
     produced = client.complete(
         store.read_events(),
         EXECUTOR_TOOLS,
-        os.environ[SENTINEL],
+        live_model,
         system="Use a tool. Do not answer in prose.",
     )
     calls = [e for e in produced if isinstance(e, ToolCall)]
@@ -75,18 +68,18 @@ def test_passthrough_round_trips_a_tool_call(tmp_path: Path) -> None:
     store.append_event(
         ToolResult(call_id=calls[0].call_id, result="app.py\ntests/", success=True)
     )
-    follow_up = client.complete(
-        store.read_events(), EXECUTOR_TOOLS, os.environ[SENTINEL]
-    )
+    follow_up = client.complete(store.read_events(), EXECUTOR_TOOLS, live_model)
     assert follow_up, "the vendor rejected or ignored the tool_result turn"
 
 
-def test_prompt_caching_survives_the_passthrough() -> None:
+def test_prompt_caching_survives_the_passthrough(
+    live_config: AgentConfig, live_model: str
+) -> None:
     # A5 asks for this to be verified rather than assumed: a proxy that
     # flattened the request would silently drop cache control and turn a
     # cost optimisation into a per-call expense.
-    base = os.environ["NISSE_LLM_BASE_URL"].rstrip("/")
-    token = os.environ["NISSE_LLM_TOKEN"]
+    base = live_config.llm_base_url.rstrip("/")
+    token = live_config.llm_token
     response = httpx.post(
         f"{base}/v1/messages",
         headers={
@@ -95,7 +88,7 @@ def test_prompt_caching_survives_the_passthrough() -> None:
             "anthropic-version": "2023-06-01",
         },
         json={
-            "model": os.environ[SENTINEL],
+            "model": live_model,
             "max_tokens": 16,
             "messages": [{"role": "user", "content": "Say pong."}],
         },