A repository per test run instead of the shared sandbox

Every live test that touches a repository gets one of its own from
e2e_support.fresh_repo, made by the test operator as an operator makes a
project's (D4, D8): seeded from tests/integration/seed/ (the sandbox's
package, without past runs' leftovers), the agent's account a collaborator
with write access, main protected (pushes only by the owner, an approval to
merge), and a deploy key generated for the run. It is deleted afterwards
(NISSE_E2E_KEEP_REPOS keeps it); scripts/e2e-cleanup.sh deletes leftovers.

- Both e2e fixtures use it; per-run base branches are gone. The merge
  helper approves first, as the protection now requires.
- test_gitea_live uses it, so CI needs NISSE_OPERATOR_TOKEN and no longer
  writes the sandbox deploy key (NISSE_PUSH_KEY).
- A live test of the helper: seeded, shared with the agent, protected
  against it, deleted.
- nisse-test.yaml's project entry is a placeholder; pytest and ruff skip
  the seed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

tests/integration/nisse-test.yaml

@@ -13,17 +13,16 @@ state_db: /tmp/nisse-test/state.db
 
 projects:
   nisse-dev-testing:
-    repo: dongar/nisse-dev-testing-sandbox    # the sandbox, never a real project
-    # The live tests replace these with a throwaway local sshd (the `ssh_host`
-    # fixture) or the bring-up build VM, in temporary directories.
+    # Placeholders: every live test that touches a repository makes one of
+    # its own (tests/integration/e2e_support.py, fresh_repo), owned by the
+    # test operator and deleted afterwards, with its own deploy key; and runs
+    # on a throwaway local sshd (the `ssh_host` fixture) or the bring-up build
+    # VM, in temporary directories.
+    repo: nisse-testing-operator/made-per-run
     workspace: /tmp/nisse-test/work
     build_host:
       address: 127.0.0.1
       key: /tmp/nisse-test/unused-key
-    # What pushes go by (D4): the sandbox's deploy key, whose private half CI
-    # writes to this path from the NISSE_PUSH_KEY secret (locally: copy it
-    # there). An HTTPS push token works too: push_user plus push_token.
-    push_key: /tmp/nisse-test/push_key
 
 llm:
   base_url: https://litellm.dongar.net