nisse-review: repository patterns, and the wall checked every round

At bring-up, nisse-review read no repositories: Gitea's /user/repos leaves
out a public repository's Read collaborators, so dev/nisse never showed up.
`repositories` now holds patterns (dev/nisse, dev/*, */*) matched against
every repository the account can read, public ones included (an
organization's or user's list, or the instance's search); unset, it is
/user/repos as before. A configured repository it can't read is left out
with an oplog line.

The read-only wall (R3) is checked every round, not only at startup: an
account granted push or admin while running stops (exit 3) rather than
review on.

nisse-core's Gitea client gains GiteaNotFound for 404s, owner_repositories
and visible_repositories.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

docs/Architecture.md

@@ -878,9 +878,13 @@ else) towards better changes.
 
 ### R1. How it works
 
-- **The duty:** watching the repositories its Gitea account can read for PRs
-  ready for review: open, not a draft, and not marked work in progress. Any
-  author's: the operator's, `nisse-dev`'s, or another tool's.
+- **The duty:** watching its repositories for PRs ready for review: open, not
+  a draft, and not marked work in progress. Any author's: the operator's,
+  `nisse-dev`'s, or another tool's. Its repositories are the ones its Gitea
+  account was given, or, when configured, those matching patterns (`dev/*`,
+  `*/*`) among all it can read, public ones included: Gitea leaves a public
+  repository's Read collaborators out of an account's own list, so access to
+  public repositories is managed in configuration, and to private ones in Gitea.
 - **A work item per PR,** scoped to its repository (L1). It closes when the PR
   merges or closes.
 - **What starts a run:** the PR becoming ready, a new push, or a new comment or
@@ -912,7 +916,10 @@ Two agents can argue forever, so a PR's exchanges are capped.
 ### R3. Authority and reach
 
 - **Read-only on the repository:** code at any ref (not only what the PR touches),
-  documents, issues, other PRs, CI status, through its Gitea account. Reads are
+  documents, issues, other PRs, CI status, through its Gitea account. The wall is
+  checked at startup and every round: an account that can push to, or
+  administer, a repository it reviews is refused, and stops if granted that
+  while running. Reads are
   bound by the harness to the item's repository, so what it might repeat in a
   comment is already visible to that repository's readers.
 - **It writes only comments and reviews on the item's PR.** Its reviews never

docs/Development-Plan.md

@@ -607,6 +607,10 @@ waits until two exist to compare. Moved, unchanged in behaviour:
   account can read (or the configured `repositories`); a work item per PR,
   ready unless a draft or titled WIP; closed when the PR merges or closes.
   Every open PR is reviewed, those open when it starts included (operator).
+  Since #153, `repositories` holds patterns (`dev/*`, `*/*`) matched against
+  every repository it can read, public ones included (Gitea's own list for the
+  account leaves out a public repository's Read collaborators, found at
+  bring-up); the read-only wall is checked every round, not only at startup.
 - **Reading (R3):** the repository at the PR's head and base, from Gitea's
   archives, unpacked into a scratch folder and read in Python (`read_file`,
   `list_files`, `search_code`), and its issues (`read_issue`,