M7.6: nisse-review's image

A `review` target in the Dockerfile: its own user (nisse-review, uid
10002), git for its clones, state and clones in /var/lib/nisse-review,
configuration at /etc/nisse-review, and only its own agent installed.
release.yml publishes gitea.dongar.net/dev/nisse-review beside nisse-dev,
at the same version. review-bringup.sh builds and runs the image, as
bringup.sh runs nisse-dev's.

The test stage adds an agent package its base lacks, without its
dependencies, since the suite's own code imports every agent's. Without
that, the tests over nisse-dev's image no longer import since
test_review_live arrived. tests/deploy/test_images.py checks the image and
that the test stage leaves what it installed as it was.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

docs/Development-Plan.md

@@ -763,6 +763,19 @@ publishes `gitea.dongar.net/dev/nisse-review` beside `nisse-dev`, and
 `review-bringup.sh` runs the image instead of a virtualenv.
 - Acceptance: a release publishes both images, and the review end-to-end tests
   run over the published `nisse-review` image.
+- The `review` target: user `nisse-review` (uid 10002), state and its clones
+  (`scratch/`) in `/var/lib/nisse-review`, configuration at
+  `/etc/nisse-review/nisse-review.yaml`, only its own agent installed. One
+  release builds every agent's image at one version: they share `nisse-core`
+  and were tested together. Older versions go by the `dev` organization's
+  package cleanup rule (keep the 10 most recent, and `latest`), set in Gitea.
+- The `test` stage adds an agent package its base lacks without its
+  dependencies, since the suite's own code imports every agent's: over
+  `nisse-review`'s image, `scripts/e2e.sh --image REF -k test_review_live`.
+  `tests/deploy/test_images.py` (needs Docker) checks that what the base
+  installed stays as it was.
+- The bring-up runs the image as root with `$REVIEW` at its own path, as
+  `bringup.sh` runs `nisse-dev`, so its config and state stay where they were.
 
 **M7.7 Deployment.** *Waits for the agent host (Phase 6).* Its container on the
 agent host, Gitea account and secrets (R5).