A repository per test run instead of the shared sandbox

Every live test that touches a repository gets one of its own from
e2e_support.fresh_repo, made by the test operator as an operator makes a
project's (D4, D8): seeded from tests/integration/seed/ (the sandbox's
package, without past runs' leftovers), the agent's account a collaborator
with write access, main protected (pushes only by the owner, an approval to
merge), and a deploy key generated for the run. It is deleted afterwards
(NISSE_E2E_KEEP_REPOS keeps it); scripts/e2e-cleanup.sh deletes leftovers.

- Both e2e fixtures use it; per-run base branches are gone. The merge
  helper approves first, as the protection now requires.
- test_gitea_live uses it, so CI needs NISSE_OPERATOR_TOKEN and no longer
  writes the sandbox deploy key (NISSE_PUSH_KEY).
- A live test of the helper: seeded, shared with the agent, protected
  against it, deleted.
- nisse-test.yaml's project entry is a placeholder; pytest and ruff skip
  the seed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

tests/integration/test_end_to_end.py

@@ -25,7 +25,7 @@ from pathlib import Path
 from typing import Any
 
 import pytest
-from e2e_support import base_branch, operator_gitea
+from e2e_support import fresh_repo, operator_gitea
 from e2e_support import task as make_task
 
 from nisse_dev.agent import Agent, build_agent
@@ -38,7 +38,7 @@ from nisse_dev.control import (
     PR_OPEN,
 )
 from nisse_dev.execution import SSHHost
-from nisse_dev.gitea import GiteaError
+from nisse_dev.gitea import GiteaClient, GiteaError
 from nisse_dev.transport import InMemoryTransport
 
 pytestmark = [pytest.mark.integration, pytest.mark.e2e]
@@ -72,10 +72,15 @@ def agent(
     run = uuid.uuid4().hex[:8]
     stack = contextlib.ExitStack()
     operator = operator_gitea(live_config.gitea_url)
-    base = stack.enter_context(base_branch(operator, live_config.gitea_repo, run))
+    account = GiteaClient(live_config.gitea_url, live_config.gitea_token).whoami()
+    fresh = stack.enter_context(
+        fresh_repo(operator, run, tmp_path / "keys", agent=account)
+    )
     config = replace(
         live_config.with_project(
-            base_branch=base,
+            repo=fresh.name,
+            base_branch="main",
+            push_key=fresh.push_key,
             workspace=Path(f"/tmp/nisse-e2e-{run}/sandbox"),
             build_host=build_host(ssh_host),
         ),
@@ -100,7 +105,7 @@ def agent(
             state_dir=tmp_path / "ssh",
         )
         host.execute(f"rm -rf /tmp/nisse-e2e-{run}")
-        stack.close()  # the run's base branch
+        stack.close()  # the run's repository
 
 
 class Operator: