Add the composition root and a runnable entry point

Nothing had ever assembled the agent. main.py was still the hello-world
placeholder from the scaffold, and no code outside the test suite
constructed an Orchestrator — which is how two fully built, fully
tested components came to be reachable from nothing: the delegation
harness, and the Gitea comment poller. Unit tests that construct a
component directly cannot catch that; only assembly can.

- config.py validates every variable before anything is built and
  names all of them at once, rather than failing at first use twenty
  minutes into a milestone on the call that mattered. Whitespace-only
  counts as missing, since a token of spaces passes a truthiness check
  and fails at the first request instead
- agent.py builds the whole graph and owns startup and shutdown order:
  reconcile before accepting commands, and on stop, stop watching,
  then stop talking, then close the store last
- The Gitea account is read via whoami rather than configured: it names
  the identity every permission is evaluated against, and proves the
  token works before anything depends on it
- Poller lifecycle is now a state-machine concern: watch the plan issue
  while a gate stands, the PR while it is open, and stop on leaving.
  The orchestrator owns when to watch; an injected factory owns how to
  build one
- The executor reports each turn, because it runs synchronously inside
  the transport callback: without it the agent is silent for a whole
  milestone and a working run looks exactly like a hung one
- main.py loads .env, builds, and shuts down cleanly on SIGINT/SIGTERM

The entry-point tests changed shape: nisse-dev no longer greets, it
refuses to start unconfigured and says everything that is missing. Both
tests now run with a deliberately empty environment and a .env path
that does not exist, because the working directory's .env holds live
credentials and a test must never be one cwd away from starting a real
agent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

nisse-dev/tests/test_dev_main.py

@@ -1,10 +1,26 @@
+from pathlib import Path
+
 import pytest
 
+from nisse_dev.config import REQUIRED
 from nisse_dev.main import main
 
 
-def test_main_prints_greeting(capsys: pytest.CaptureFixture[str]) -> None:
-    main()
-    assert (
-        capsys.readouterr().out == "Hello from nisse-dev, the house spirit is awake.\n"
-    )
+def test_main_refuses_to_start_without_configuration(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+    tmp_path: Path,
+) -> None:
+    # Clear the real variables rather than swapping os.environ: from_env binds
+    # the environment object as a default argument, so a replacement would be
+    # ignored. And point NISSE_ENV at a file that does not exist, because the
+    # working directory's .env holds live credentials.
+    for name in REQUIRED:
+        monkeypatch.delenv(name, raising=False)
+    monkeypatch.setenv("NISSE_ENV", str(tmp_path / "absent.env"))
+
+    assert main() == 2
+
+    err = capsys.readouterr().err
+    assert "cannot start" in err
+    assert "NISSE_LLM_TOKEN" in err