A repository per test run instead of the shared sandbox

Every live test that touches a repository gets one of its own from
e2e_support.fresh_repo, made by the test operator as an operator makes a
project's (D4, D8): seeded from tests/integration/seed/ (the sandbox's
package, without past runs' leftovers), the agent's account a collaborator
with write access, main protected (pushes only by the owner, an approval to
merge), and a deploy key generated for the run. It is deleted afterwards
(NISSE_E2E_KEEP_REPOS keeps it); scripts/e2e-cleanup.sh deletes leftovers.

- Both e2e fixtures use it; per-run base branches are gone. The merge
  helper approves first, as the protection now requires.
- test_gitea_live uses it, so CI needs NISSE_OPERATOR_TOKEN and no longer
  writes the sandbox deploy key (NISSE_PUSH_KEY).
- A live test of the helper: seeded, shared with the agent, protected
  against it, deleted.
- nisse-test.yaml's project entry is a placeholder; pytest and ruff skip
  the seed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

tests/integration/test_end_to_end_loop.py

@@ -21,7 +21,7 @@ from pathlib import Path
 from typing import Any
 
 import pytest
-from e2e_support import base_branch, dependent_task, operator_gitea, task
+from e2e_support import dependent_task, fresh_repo, operator_gitea, task
 
 from nisse_dev.config import AgentConfig, LoopTuning
 from nisse_dev.execution import SSHHost
@@ -63,10 +63,13 @@ def running(
     keep.mkdir(parents=True, exist_ok=True)
     print(f"\ne2e run {run}: state store in {keep}")
     operator = operator_gitea(live_config.gitea_url)
-    base = stack.enter_context(base_branch(operator, live_config.gitea_repo, run))
+    account = GiteaClient(live_config.gitea_url, live_config.gitea_token).whoami()
+    fresh = stack.enter_context(fresh_repo(operator, run, keep / "keys", agent=account))
     config = replace(
         live_config.with_project(
-            base_branch=base,
+            repo=fresh.name,
+            base_branch="main",
+            push_key=fresh.push_key,
             workspace=Path(f"/tmp/nisse-e2e-{run}/sandbox"),
             build_host=build_host(ssh_host),
         ),
@@ -95,7 +98,7 @@ def running(
             state_dir=tmp_path / "ssh",
         )
         host.execute(f"rm -rf /tmp/nisse-e2e-{run}")
-        stack.close()  # the run's base branch
+        stack.close()  # the run's repository
 
 
 def is_artifact(path: str) -> bool:
@@ -108,8 +111,14 @@ def is_artifact(path: str) -> bool:
 
 
 def merge(gitea: GiteaClient, repo: str, pr: int, wait_s: float = 60) -> None:
-    """Merge, waiting out Gitea's "Please try again later": it answers that
-    while it is still checking a freshly pushed PR can merge."""
+    """Approve and merge, waiting out Gitea's "Please try again later": it
+    answers that while it is still checking a freshly pushed PR can merge."""
+    with contextlib.suppress(GiteaError):  # approved already
+        gitea._request(
+            "POST",
+            f"/repos/{repo}/pulls/{pr}/reviews",
+            json={"event": "APPROVED", "body": "looks good"},
+        )
     deadline = time.monotonic() + wait_s
     while True:
         try: