nisse-review: repository patterns, and the wall checked every round

At bring-up, nisse-review read no repositories: Gitea's /user/repos leaves
out a public repository's Read collaborators, so dev/nisse never showed up.
`repositories` now holds patterns (dev/nisse, dev/*, */*) matched against
every repository the account can read, public ones included (an
organization's or user's list, or the instance's search); unset, it is
/user/repos as before. A configured repository it can't read is left out
with an oplog line.

The read-only wall (R3) is checked every round, not only at startup: an
account granted push or admin while running stops (exit 3) rather than
review on.

nisse-core's Gitea client gains GiteaNotFound for 404s, owner_repositories
and visible_repositories.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

nisse-review/src/nisse_review/config.py

@@ -43,8 +43,8 @@ REQUIRED_KEYS = (
 OPTIONAL_KEYS = (
     "llm.max_output_tokens",
     "llm.request_timeout_s",
-    # Only these of the repositories it can read; unset, every one (R1).
-    # For tests and a first bring-up.
+    # Patterns of the repositories it reviews ("dev/nisse", "dev/*", "*/*"),
+    # public ones included; unset, every one it was given (R1, ``access``).
     "repositories",
 )
 
@@ -132,6 +132,11 @@ class ReviewConfig:
         if missing:
             errors.append("unset or empty — " + ", ".join(missing))
         max_output, timeout = llm_numbers(values, errors)
+        patterns = people(values["repositories"]) if "repositories" in values else None
+        for pattern in sorted(patterns or ()):
+            owner, slash, name = pattern.partition("/")
+            if not (owner and slash and name) or "/" in name:
+                errors.append(f"repositories: {pattern!r} is not owner/name")
         if errors:
             raise ConfigError("cannot start: " + "; ".join(errors))
         reviewer = str(values["roles.reviewer"])
@@ -149,7 +154,5 @@ class ReviewConfig:
             request_timeout_s=timeout,
             tuning=tuning,
             vault=vault,
-            repositories=(
-                people(values["repositories"]) if "repositories" in values else None
-            ),
+            repositories=patterns,
         )