A repository per test run instead of the shared sandbox

Every live test that touches a repository gets one of its own from
e2e_support.fresh_repo, made by the test operator as an operator makes a
project's (D4, D8): seeded from tests/integration/seed/ (the sandbox's
package, without past runs' leftovers), the agent's account a collaborator
with write access, main protected (pushes only by the owner, an approval to
merge), and a deploy key generated for the run. It is deleted afterwards
(NISSE_E2E_KEEP_REPOS keeps it); scripts/e2e-cleanup.sh deletes leftovers.

- Both e2e fixtures use it; per-run base branches are gone. The merge
  helper approves first, as the protection now requires.
- test_gitea_live uses it, so CI needs NISSE_OPERATOR_TOKEN and no longer
  writes the sandbox deploy key (NISSE_PUSH_KEY).
- A live test of the helper: seeded, shared with the agent, protected
  against it, deleted.
- nisse-test.yaml's project entry is a placeholder; pytest and ruff skip
  the seed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

.gitea/workflows/ci.yml

@@ -42,15 +42,6 @@ jobs:
       - name: Unit tests
         run: uv run pytest -m "not integration and not e2e"
 
-      - name: Push key
-        # The sandbox's deploy key, where nisse-test.yaml expects it.
-        env:
-          NISSE_PUSH_KEY: ${{ secrets.NISSE_PUSH_KEY }}
-        run: |
-          mkdir -p /tmp/nisse-test
-          printf '%s\n' "$NISSE_PUSH_KEY" > /tmp/nisse-test/push_key
-          chmod 600 /tmp/nisse-test/push_key
-
       - name: Integration tests
         # Everything but the secrets is in tests/integration/nisse-test.yaml,
         # which refers to these by name. A missing secret fails the live
@@ -59,4 +50,7 @@ jobs:
           NISSE_LLM_TOKEN: ${{ secrets.NISSE_LLM_TOKEN }}
           NISSE_MATRIX_TOKEN: ${{ secrets.NISSE_MATRIX_TOKEN }}
           NISSE_GITEA_TOKEN: ${{ secrets.NISSE_GITEA_TOKEN }}
+          # The test operator, who makes each run's repository (and its deploy
+          # key) and deletes it afterwards.
+          NISSE_OPERATOR_TOKEN: ${{ secrets.NISSE_OPERATOR_TOKEN }}
         run: uv run pytest -m "integration and not e2e" -rs