Add Gitea client and git operations (B2) — step 6a, part 1

The standalone half of the Gitea layer; orchestrator wiring follows
once the executor loop lands, to avoid colliding with it in
control.py.

- gitea.py: GiteaClient over httpx — open PRs, list and post issue
  comments, close PRs. find_pull_request is the A3 external-truth
  query that makes opening a PR idempotent across a crash, and it
  checks closed PRs too, since a crash after opening must not be
  answered with "nothing is open, so open another"
- pull_request_reconciler: an unreachable Gitea returns None rather
  than a guess, so the agent gates to the human instead of risking a
  duplicate side effect
- git.py: branch, commit, push for the workspace. The token is passed
  per-invocation rather than stored as a remote, so it never lands in
  .git/config, and anything raised is scrubbed of it
- commit_all returns None when there is nothing to commit: an empty
  milestone is a fact to report, not an error
- Live test does the real round trip against the sandbox repo and
  cleans up after itself

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/integration/test_gitea_live.py

@@ -0,0 +1,95 @@
+"""Live Gitea round trip against the sandbox repo: push a branch, open a PR,
+comment, and prove the A3 reconciler reads external truth correctly.
+
+Cleans up after itself (closes the PR, deletes the branch) so repeated runs
+do not silt up the sandbox.
+"""
+
+import os
+import uuid
+from pathlib import Path
+
+import pytest
+
+from nisse_dev.envfile import load_env_file
+from nisse_dev.git import GitRepo, authenticated_url
+from nisse_dev.gitea import GiteaClient, pull_request_reconciler
+from nisse_dev.state import Intent
+
+load_env_file(Path(__file__).resolve().parents[2] / ".env")
+
+SENTINEL = "NISSE_GITEA_URL"
+ALSO_REQUIRED = ("NISSE_GITEA_TOKEN", "NISSE_GITEA_TEST_REPO")
+
+pytestmark = [
+    pytest.mark.integration,
+    pytest.mark.skipif(
+        not os.environ.get(SENTINEL),
+        reason=f"no live Gitea configured ({SENTINEL} unset)",
+    ),
+]
+
+
+def intent_for(branch: str) -> Intent:
+    return Intent(
+        id=1,
+        kind="open_pr",
+        payload={"branch": branch},
+        status="pending",
+        created_at="t",
+        resolved_at=None,
+    )
+
+
+def test_push_open_pr_and_reconcile(tmp_path: Path) -> None:
+    missing = [var for var in ALSO_REQUIRED if not os.environ.get(var)]
+    assert not missing, (
+        f"{SENTINEL} is set, so the live Gitea path is expected to work, "
+        f"but these are missing: {', '.join(missing)}"
+    )
+    base_url = os.environ[SENTINEL]
+    token = os.environ["NISSE_GITEA_TOKEN"]
+    repo_path = os.environ["NISSE_GITEA_TEST_REPO"]
+    client = GiteaClient.from_env()
+
+    account = client.whoami()
+    assert "testing" in account, (
+        f"live tests must run as a testing account, not {account}"
+    )
+
+    branch = f"live-test-{uuid.uuid4().hex[:8]}"
+    reconcile = pull_request_reconciler(client, repo_path)
+
+    # Before the PR exists, external truth says the effect has not happened.
+    assert reconcile(intent_for(branch)) is False
+
+    repo = GitRepo(tmp_path / "work")
+    repo.init()
+    repo.configure_identity(account, f"{account}@example.test")
+    (repo.root / f"{branch}.txt").write_text("live test artifact\n")
+    assert repo.commit_all("Live test commit") is not None
+
+    url = authenticated_url(base_url, repo_path, account, token)
+    pr = None
+    try:
+        repo.push(url, branch, token=token)
+        pr = client.open_pull_request(
+            repo_path,
+            head=branch,
+            base="main",
+            title=f"live test {branch}",
+            body="Opened by the nisse-dev live test suite.",
+        )
+        assert pr.head == branch
+
+        client.post_comment(repo_path, pr.number, "live test comment")
+        bodies = [c.body for c in client.list_comments(repo_path, pr.number)]
+        assert "live test comment" in bodies
+
+        # Now the same reconciler must see the effect and refuse to repeat it.
+        assert reconcile(intent_for(branch)) is True
+    finally:
+        if pr is not None:
+            client.close_pull_request(repo_path, pr.number)
+        repo.delete_remote_branch(url, branch, token=token)
+        client.close()