Add the composition root and a runnable entry point

Nothing had ever assembled the agent. main.py was still the hello-world
placeholder from the scaffold, and no code outside the test suite
constructed an Orchestrator — which is how two fully built, fully
tested components came to be reachable from nothing: the delegation
harness, and the Gitea comment poller. Unit tests that construct a
component directly cannot catch that; only assembly can.

- config.py validates every variable before anything is built and
  names all of them at once, rather than failing at first use twenty
  minutes into a milestone on the call that mattered. Whitespace-only
  counts as missing, since a token of spaces passes a truthiness check
  and fails at the first request instead
- agent.py builds the whole graph and owns startup and shutdown order:
  reconcile before accepting commands, and on stop, stop watching,
  then stop talking, then close the store last
- The Gitea account is read via whoami rather than configured: it names
  the identity every permission is evaluated against, and proves the
  token works before anything depends on it
- Poller lifecycle is now a state-machine concern: watch the plan issue
  while a gate stands, the PR while it is open, and stop on leaving.
  The orchestrator owns when to watch; an injected factory owns how to
  build one
- The executor reports each turn, because it runs synchronously inside
  the transport callback: without it the agent is silent for a whole
  milestone and a working run looks exactly like a hung one
- main.py loads .env, builds, and shuts down cleanly on SIGINT/SIGTERM

The entry-point tests changed shape: nisse-dev no longer greets, it
refuses to start unconfigured and says everything that is missing. Both
tests now run with a deliberately empty environment and a .env path
that does not exist, because the working directory's .env holds live
credentials and a test must never be one cwd away from starting a real
agent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/integration/test_entry_points.py

@@ -1,5 +1,6 @@
 """Integration tests: run the installed console scripts as real subprocesses."""
 
+import os
 import subprocess
 
 import pytest
@@ -7,10 +8,35 @@ import pytest
 pytestmark = pytest.mark.integration
 
 
-@pytest.mark.parametrize("agent", ["nisse-dev", "nisse-ops"])
-def test_entry_point_runs_and_greets(agent: str) -> None:
+def test_ops_entry_point_runs_and_greets() -> None:
     result = subprocess.run(
-        [agent], capture_output=True, text=True, timeout=30, check=False
+        ["nisse-ops"], capture_output=True, text=True, timeout=30, check=False
     )
     assert result.returncode == 0
-    assert result.stdout == f"Hello from {agent}, the house spirit is awake.\n"
+    assert result.stdout == "Hello from nisse-ops, the house spirit is awake.\n"
+
+
+def test_dev_entry_point_refuses_to_start_unconfigured() -> None:
+    """Missing configuration must fail at startup, naming everything absent.
+
+    Run with a deliberately empty environment and a .env path that does not
+    exist: the real .env in the working directory holds live credentials, and
+    a test must never be one cwd away from starting a real agent.
+    """
+    result = subprocess.run(
+        ["nisse-dev"],
+        capture_output=True,
+        text=True,
+        timeout=30,
+        check=False,
+        env={
+            "PATH": os.environ["PATH"],
+            "HOME": os.environ["HOME"],
+            "NISSE_ENV": "/nonexistent/.env",
+        },
+    )
+    assert result.returncode == 2
+    assert "cannot start" in result.stderr
+    # All of them at once, not the first one it happened to reach.
+    for expected in ("NISSE_STATE_DB", "NISSE_MATRIX_TOKEN", "NISSE_GITEA_REPO"):
+        assert expected in result.stderr