nisse-review: read code from a git clone kept between runs

Archives were downloaded and unpacked afresh for every run, which doesn't
scale to very large repositories. Each repository is now cloned once, with
its whole history, under scratch/repos/<owner>/<name>/ (head/ the clone,
base/ a worktree when read). A run fetches every branch and the PR's
refs/pull/N/head, checks out the head exactly, and fails if that head is
gone. Only the latest repository is kept for now.

Git runs walled off: none of the host's git configuration, links checked
out as plain files, no hooks, submodules or LFS, only the Gitea URL's
protocol, and the token as an http.extraHeader for that URL in git's
environment only. A stop ends a git command; a cut-short first clone is
removed. The reader never shows .git. GiteaClient.archive is gone.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

nisse-core/src/nisse_core/gitea.py

@@ -135,7 +135,7 @@ class GiteaClient:
         return response.json() if response.content else None
 
     def _raw(self, path: str, **kwargs: Any) -> bytes:
-        """A GET whose answer isn't JSON: a diff, an archive."""
+        """A GET whose answer isn't JSON: a diff."""
         try:
             response = self._http.get(path, **kwargs)
         except httpx.HTTPError as exc:
@@ -466,10 +466,6 @@ class GiteaClient:
             found.append(f"{str(item.get('sha', ''))[:7]} {first}".strip())
         return found
 
-    def archive(self, repo: str, ref: str) -> bytes:
-        """The repository at ``ref`` (a commit or branch), as a .tar.gz."""
-        return self._raw(f"/repos/{repo}/archive/{ref}.tar.gz")
-
     def issue(self, repo: str, index: int) -> Issue:
         return _issue(self._request("GET", f"/repos/{repo}/issues/{index}"))