A repository per test run instead of the shared sandbox

Every live test that touches a repository gets one of its own from
e2e_support.fresh_repo, made by the test operator as an operator makes a
project's (D4, D8): seeded from tests/integration/seed/ (the sandbox's
package, without past runs' leftovers), the agent's account a collaborator
with write access, main protected (pushes only by the owner, an approval to
merge), and a deploy key generated for the run. It is deleted afterwards
(NISSE_E2E_KEEP_REPOS keeps it); scripts/e2e-cleanup.sh deletes leftovers.

- Both e2e fixtures use it; per-run base branches are gone. The merge
  helper approves first, as the protection now requires.
- test_gitea_live uses it, so CI needs NISSE_OPERATOR_TOKEN and no longer
  writes the sandbox deploy key (NISSE_PUSH_KEY).
- A live test of the helper: seeded, shared with the agent, protected
  against it, deleted.
- nisse-test.yaml's project entry is a placeholder; pytest and ruff skip
  the seed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

pyproject.toml

@@ -14,7 +14,8 @@ testpaths = [
     "nisse-ops/tests",
     "tests",
 ]
-addopts = "--strict-markers"
+# The seed is a test project's own code, pushed to each run's repository.
+addopts = "--strict-markers --ignore=tests/integration/seed"
 markers = [
     "integration: end-to-end tests that exercise installed entry points or external services",
     "e2e: the whole agent against real services, run after each milestone (scripts/e2e.sh)",
@@ -22,6 +23,7 @@ markers = [
 
 [tool.ruff]
 target-version = "py312"
+extend-exclude = ["tests/integration/seed"]  # a test project's own code
 
 [tool.ruff.lint]
 extend-select = ["I"]