nisse-review: repository patterns, and the wall checked every round

At bring-up, nisse-review read no repositories: Gitea's /user/repos leaves
out a public repository's Read collaborators, so dev/nisse never showed up.
`repositories` now holds patterns (dev/nisse, dev/*, */*) matched against
every repository the account can read, public ones included (an
organization's or user's list, or the instance's search); unset, it is
/user/repos as before. A configured repository it can't read is left out
with an oplog line.

The read-only wall (R3) is checked every round, not only at startup: an
account granted push or admin while running stops (exit 3) rather than
review on.

nisse-core's Gitea client gains GiteaNotFound for 404s, owner_repositories
and visible_repositories.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

nisse-core/tests/test_gitea.py

@@ -8,6 +8,7 @@ from nisse_core.gitea import (
     Comment,
     GiteaClient,
     GiteaError,
+    GiteaNotFound,
     pull_request_reconciler,
 )
 from nisse_core.state.store import Intent
@@ -360,6 +361,33 @@ def test_readable_repositories_page_to_the_end() -> None:
     assert len(found) == PR_PAGE_SIZE + 2 and found[-1] == "o/r2-1"
 
 
+def test_owner_repositories_try_the_organization_then_the_user() -> None:
+    asked: list[str] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        asked.append(request.url.path)
+        if request.url.path.startswith("/api/v1/orgs/"):
+            return httpx.Response(404, json={"message": "not found"})
+        return httpx.Response(200, json=[{"full_name": "don/r"}])
+
+    assert client(handler).owner_repositories("don") == ["don/r"]
+    assert asked == ["/api/v1/orgs/don/repos", "/api/v1/users/don/repos"]
+
+
+def test_visible_repositories_read_the_search_and_a_404_is_not_found() -> None:
+    def handler(request: httpx.Request) -> httpx.Response:
+        if request.url.path.endswith("/repos/search"):
+            return httpx.Response(
+                200, json={"ok": True, "data": [{"full_name": "d/n"}]}
+            )
+        return httpx.Response(404, json={"message": "not found"})
+
+    gitea = client(handler)
+    assert gitea.visible_repositories() == ["d/n"]
+    with pytest.raises(GiteaNotFound):
+        gitea.repository("d/gone")
+
+
 def test_a_pull_request_carries_what_a_review_needs() -> None:
     def handler(request: httpx.Request) -> httpx.Response:
         if request.url.path.endswith(".diff"):