Make nisse-testing-operator a Gitea operator in the test config only

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

.env.example

@@ -11,6 +11,9 @@ NISSE_LLM_TOKEN=replace-me
 NISSE_MATRIX_TOKEN=replace-me
 # gitea.token: the Gitea service account's scoped token (B2)
 NISSE_GITEA_TOKEN=replace-me
+# The end-to-end tests' scripted operator (nisse-testing-operator): scopes
+# write:issue and write:repository, write access to the sandbox only.
+NISSE_OPERATOR_TOKEN=replace-me
 # The live push test reads the sandbox's deploy key from the path in
 # tests/integration/nisse-test.yaml (gitea.push_key), not from here.
 

tests/integration/nisse-test.yaml

@@ -41,7 +41,9 @@ gitea:
   url: https://gitea.dongar.net
   token: ${NISSE_GITEA_TOKEN}
   repo: dongar/nisse-dev-testing-sandbox      # the sandbox, never a real project
-  operators: [dongar]
+  # nisse-testing-operator plays the operator in the end-to-end tests
+  # (NISSE_OPERATOR_TOKEN); an operator here and nowhere else.
+  operators: [dongar, nisse-testing-operator]
   # What pushes go by (D4): the sandbox's deploy key, whose private half CI
   # writes to this path from the NISSE_PUSH_KEY secret (locally: copy it
   # there). An HTTPS push token works too: push_user plus push_token.