Check loop.qnt's properties against the real loop (M2.1, PR D part 1)

test_loop_properties.py walks the new loop with a seeded mix of operator
and Gitea actions (go-aheads, stale go-aheads, answers, comments, merges,
the comment-then-merge race, closes, abandon, a crash and restart) and an
adaptive scripted model, checking every loop.qnt property after every
step. It found two bugs, both fixed with regression tests: abandoning an
item left its open PR open (the model's fix 1, now in code), and after a
review fix became a follow-up PR, the next fix went to the merged branch.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

specs/README.md

@@ -65,6 +65,13 @@ Traces need about 80 steps to reach second milestones. The `w_*` values at the
 end are reachability witnesses: each should be *violated*, which shows the
 state it names is reachable.
 
+**Against the real code.** `nisse-dev/tests/test_loop_properties.py` checks
+the same properties against the new loop itself: a seeded random walk over
+what the operator and Gitea can do (go-aheads, answers, comments, merges,
+closes, abandon, a crash and restart), checking every property after every
+step. It found two bugs the design model couldn't, because they were in the
+code: abandon left an open PR, and a review fix after a follow-up PR went to
+the merged branch. Each also has its own regression test.
+
 **Keeping it true.** When the architecture changes a rule this models, change
-the model in the same PR. When the new loop is built (Development Plan Phase 2),
-each property gets a test against the real code, as `orchestrator.qnt`'s did.
+the model and the walk in the same PR.