M2.8: switch over to the new loop

nisse-dev now runs only the conversational loop. The gated state machine
it was built alongside is gone:

- Removed control.py, planner.py, executor.py, approvals.py, gates.py
  (command_form moves to loop/reader.py), publish.py and poller.py, the
  old assembly in agent.py (its shared helpers move to loop/build.py),
  the store's state-machine view (get_state, transition), their tests,
  the old end-to-end and live planning/milestone/gate tests, and
  specs/orchestrator.qnt with its scenarios.
- Roles are driver, helper, expert and classifier; driver is required.
  loop:, roles.planner, roles.executor and tuning.executor are refused
  with what to use instead; tuning.driver takes the turn cap and failure
  limit.
- The benchmark and the capability matrix measure the driver: the
  loop's own system prompt and tools, the task's plan as the agreed
  restatement. Task plans end with finish_milestone, so earlier runs
  show as (old); stored runs' executor tuning reads as the driver's.
- A delegation on the loop records what its helper's alias resolved to
  (L9), as the old path's did.
- The dump shows a work item's revision and what it waits for.
- Behaviour the old tests covered and the loop shares stays covered:
  driver runs that fail on a model call, stop mid-turn, reset the
  failure count; go-aheads ignoring case and punctuation; a request too
  big to fit is never sent; the assembly tests, now on build_loop_agent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

specs/README.md

@@ -6,41 +6,19 @@ it finds flaws the design and the code share, not places where the code
 strays from the design. So every counterexample is also reproduced as a failing
 test against the real code before anything is changed.
 
-## `orchestrator.qnt`: nisse-dev's control loop
-
-Models `nisse-dev/src/nisse_dev/control.py`: the states, the gate, pending
-questions, Gitea comment cursors, publish intents, and the worker queue.
-Operator messages, Gitea comments, planner/executor/publisher outcomes
-(exceptions included) and **a crash at any point** all interleave freely.
-Each pure function is named after the method it mirrors.
-
-The properties are at the end of the file (`all_properties` is their
-conjunction). Counterexamples are written out as short traces in
-`orchestrator_scenarios.qnt`, and replayed against the real code in
-`nisse-dev/tests/test_quint_counterexamples.py`.
-
 ```sh
 npm install -g @informalsystems/quint     # 0.33 or later
-
-# Random simulation, one property at a time:
-quint run specs/orchestrator.qnt --invariant=no_stranding \
-    --max-steps=40 --max-samples=200000
-
-# The counterexample traces (each expects its property to break):
-quint test specs/orchestrator_scenarios.qnt
 ```
 
 Exhaustive bounded checking (`quint verify`) uses Apalache and needs Java 17.
 
-**Keeping it true.** When `control.py` changes how a state is entered or
-left, change the matching function here in the same PR. When a
-counterexample's fix lands, flip its scenario's `expect` to the property
-holding, and drop the `xfail` from its Python reproduction.
+The gated state machine the agent ran before the switch-over (M2.8) had its
+own model, `orchestrator.qnt`; it went with that code, and is in the history.
 
 ## `loop.qnt`: the agent loop, as the architecture describes it
 
-Models the design in `docs/Architecture.md` rather than code, since the new
-loop doesn't exist yet:
+Models the design in `docs/Architecture.md` rather than the code (it was
+written before the loop was):
 - work items from assigned issues and conversations;
 - restatements and revision-bound go-aheads;
 - park-and-switch, with branches pushed on parking;
@@ -66,7 +44,7 @@ end are reachability witnesses: each should be *violated*, which shows the
 state it names is reachable.
 
 **Against the real code.** `nisse-dev/tests/test_loop_properties.py` checks
-the same properties against the new loop itself: a seeded random walk over
+the same properties against the loop itself: a seeded random walk over
 what the operator and Gitea can do (go-aheads, answers, comments, merges,
 closes, abandon, a crash and restart), checking every property after every
 step. It found two bugs the design model couldn't, because they were in the