nisse-review: read code from a git clone kept between runs

Archives were downloaded and unpacked afresh for every run, which doesn't
scale to very large repositories. Each repository is now cloned once, with
its whole history, under scratch/repos/<owner>/<name>/ (head/ the clone,
base/ a worktree when read). A run fetches every branch and the PR's
refs/pull/N/head, checks out the head exactly, and fails if that head is
gone. Only the latest repository is kept for now.

Git runs walled off: none of the host's git configuration, links checked
out as plain files, no hooks, submodules or LFS, only the Gitea URL's
protocol, and the token as an http.extraHeader for that URL in git's
environment only. A stop ends a git command; a cut-short first clone is
removed. The reader never shows .git. GiteaClient.archive is gone.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

docs/Architecture.md

@@ -928,7 +928,11 @@ Two agents can argue forever, so a PR's exchanges are capped.
   administer, a repository it reviews is refused, and stops if granted that
   while running. Reads are
   bound by the harness to the item's repository, so what it might repeat in a
-  comment is already visible to that repository's readers.
+  comment is already visible to that repository's readers. The code is a git
+  clone kept on its host between runs, checked out at the PR's head (and its
+  base when asked); git runs only the harness's fixed commands, walled off from
+  the host's git configuration and from anything the code could make it run
+  (links, hooks, submodules).
 - **It writes only comments and reviews on the item's PR.** Its reviews never
   approve and never request changes: the operator's approval alone counts for
   merging (D5), and Gitea's branch protection enforces it.