A repository per test run instead of the shared sandbox

Every live test that touches a repository gets one of its own from
e2e_support.fresh_repo, made by the test operator as an operator makes a
project's (D4, D8): seeded from tests/integration/seed/ (the sandbox's
package, without past runs' leftovers), the agent's account a collaborator
with write access, main protected (pushes only by the owner, an approval to
merge), and a deploy key generated for the run. It is deleted afterwards
(NISSE_E2E_KEEP_REPOS keeps it); scripts/e2e-cleanup.sh deletes leftovers.

- Both e2e fixtures use it; per-run base branches are gone. The merge
  helper approves first, as the protection now requires.
- test_gitea_live uses it, so CI needs NISSE_OPERATOR_TOKEN and no longer
  writes the sandbox deploy key (NISSE_PUSH_KEY).
- A live test of the helper: seeded, shared with the agent, protected
  against it, deleted.
- nisse-test.yaml's project entry is a placeholder; pytest and ruff skip
  the seed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

scripts/e2e-cleanup.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Delete test repositories a live test run left behind (it died before its
+# teardown): the test operator's nisse-e2e-* repositories older than a day,
+# or of any age with --all. Needs NISSE_OPERATOR_TOKEN (from .env).
+#
+#   scripts/e2e-cleanup.sh          older than a day
+#   scripts/e2e-cleanup.sh --all    every one, e.g. when nothing is running
+set -euo pipefail
+cd "$(dirname "$0")/.."
+if [ -f .env ]; then set -a; . ./.env; set +a; fi
+exec uv run python - "$@" <<'PY'
+import os, sys
+from datetime import datetime, timedelta, timezone
+from nisse_dev.gitea import GiteaClient
+
+gitea = GiteaClient("https://gitea.dongar.net", os.environ["NISSE_OPERATOR_TOKEN"])
+cutoff = datetime.now(timezone.utc) - (timedelta(0) if "--all" in sys.argv else timedelta(days=1))
+page, gone = 1, 0
+while True:
+    repos = gitea._request("GET", "/user/repos", params={"page": page, "limit": 50})
+    if not repos:
+        break
+    for repo in repos:
+        created = datetime.fromisoformat(repo["created_at"].replace("Z", "+00:00"))
+        if repo["name"].startswith("nisse-e2e-") and created < cutoff:
+            gitea._request("DELETE", f"/repos/{repo['full_name']}")
+            print("deleted", repo["full_name"])
+            gone += 1
+    page += 1
+print(f"{gone} deleted")
+PY