Make the config file the only home for settings

With no production instance yet, there is no reason to carry two ways
of configuring the agent. Every environment variable that duplicated a
config key is gone; the environment now supplies only the secrets the
file references by ${…}, plus NISSE_CONFIG and NISSE_ENV to find the
files.

- AgentConfig loads from a file (load, from_file) or a parsed tree
  (from_tree, for tests); a missing file is an error naming the example
- The from_env constructors on LiteLLMClient, AnthropicPassthroughClient,
  GiteaClient, MatrixConfig and RoleMap are removed, with the env
  reading for max output tokens; clients take their settings from config
- The live integration tests share a committed agent config,
  tests/integration/nisse-test.yaml, aimed at test resources, and one
  conftest that loads it and builds clients. NISSE_LIVE_PLANNER_MODEL
  becomes its planner role; NISSE_CAPABILITY_MODELS stays as a per-run
  switch
- A missing secret now fails the live tests instead of skipping them
- CI passes only the three tokens
- .env.example is secrets only; spec A5 says config comes from the file

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/integration/test_planning_live.py

@@ -1,47 +1,30 @@
 """Live planning turn: a real model must answer with a submit_plan or
 ask_human tool call, not prose.
 
-Deliberately opt-in via NISSE_LIVE_PLANNER_MODEL rather than the usual
-NISSE_LLM_BASE_URL sentinel. Planning escalates to a frontier model
-unconditionally (A12), and the small local model does not hold the tool-call
-contract reliably — measured, see the PR — so this test needs a frontier
-route that does not exist yet. Set the variable to the model to plan with
-once one is configured; until then this skips on purpose, not by accident.
+Plans with the test config's planner role. Planning escalates to a frontier
+model unconditionally (A12), and small local models do not hold the tool-call
+contract reliably, so that role must be one that does.
 """
 
 import io
-import os
 from pathlib import Path
 
 import pytest
 
 from nisse_dev.canonical import UserMessage
 from nisse_dev.control import AskHuman, SubmitPlan
-from nisse_dev.envfile import load_env_file
 from nisse_dev.llm import LiteLLMClient, RoleMap
 from nisse_dev.oplog import OpLog
 from nisse_dev.planner import LLMPlanningAgent
 from nisse_dev.state import StateStore
 
-load_env_file(Path(__file__).resolve().parents[2] / ".env")
-
-SENTINEL = "NISSE_LIVE_PLANNER_MODEL"
-
-pytestmark = [
-    pytest.mark.integration,
-    pytest.mark.skipif(
-        not os.environ.get(SENTINEL),
-        reason=f"no frontier planner route configured ({SENTINEL} unset)",
-    ),
-]
+pytestmark = pytest.mark.integration
 
 
-def test_live_planning_turn_returns_a_tool_action(tmp_path: Path) -> None:
-    assert os.environ.get("NISSE_LLM_TOKEN"), (
-        f"{SENTINEL} is set, so the live planning path is expected to work, "
-        "but NISSE_LLM_TOKEN is missing"
-    )
-    model = os.environ[SENTINEL]
+def test_live_planning_turn_returns_a_tool_action(
+    tmp_path: Path, litellm: LiteLLMClient, live_model: str
+) -> None:
+    model = live_model
     roles = RoleMap(executor=model, planner=model, delegate=model, consultant=model)
     store = StateStore(tmp_path / "state.db", oplog=OpLog("nisse-dev", io.StringIO()))
     store.append_event(
@@ -53,7 +36,7 @@ def test_live_planning_turn_returns_a_tool_action(tmp_path: Path) -> None:
             source="live-test",
         )
     )
-    agent = LLMPlanningAgent(LiteLLMClient.from_env(), store, roles)
+    agent = LLMPlanningAgent(litellm, store, roles)
 
     action = agent.plan("arch", "hello-cli")