Add the composition root and a runnable entry point

Nothing had ever assembled the agent. main.py was still the hello-world
placeholder from the scaffold, and no code outside the test suite
constructed an Orchestrator — which is how two fully built, fully
tested components came to be reachable from nothing: the delegation
harness, and the Gitea comment poller. Unit tests that construct a
component directly cannot catch that; only assembly can.

- config.py validates every variable before anything is built and
  names all of them at once, rather than failing at first use twenty
  minutes into a milestone on the call that mattered. Whitespace-only
  counts as missing, since a token of spaces passes a truthiness check
  and fails at the first request instead
- agent.py builds the whole graph and owns startup and shutdown order:
  reconcile before accepting commands, and on stop, stop watching,
  then stop talking, then close the store last
- The Gitea account is read via whoami rather than configured: it names
  the identity every permission is evaluated against, and proves the
  token works before anything depends on it
- Poller lifecycle is now a state-machine concern: watch the plan issue
  while a gate stands, the PR while it is open, and stop on leaving.
  The orchestrator owns when to watch; an injected factory owns how to
  build one
- The executor reports each turn, because it runs synchronously inside
  the transport callback: without it the agent is silent for a whole
  milestone and a working run looks exactly like a hung one
- main.py loads .env, builds, and shuts down cleanly on SIGINT/SIGTERM

The entry-point tests changed shape: nisse-dev no longer greets, it
refuses to start unconfigured and says everything that is missing. Both
tests now run with a deliberately empty environment and a .env path
that does not exist, because the working directory's .env holds live
credentials and a test must never be one cwd away from starting a real
agent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -34,3 +34,13 @@ NISSE_GITEA_TEST_REPO=owner/sandbox-repo
 # Gitea logins allowed to drive the agent via PR comments (A4 per-channel
 # allowlist; a Matrix MXID and a Gitea login are different names).
 NISSE_GITEA_OPERATORS=your-gitea-login
+
+# --- Running the agent (the demo, not the tests) ---
+# The tests use NISSE_GITEA_TEST_REPO; a running agent uses these.
+NISSE_STATE_DB=~/nisse-demo-workspace/state.db
+NISSE_WORKSPACE=~/nisse-demo-workspace/project
+NISSE_PROJECT=demo
+NISSE_GITEA_REPO=owner/demo-repo
+# NISSE_BASE_BRANCH=main
+# Path to this file, if not ./.env
+# NISSE_ENV=~/nisse-demo-workspace/.env