Merge main into agent-host-vault

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

scripts/review-bringup.sh

@@ -2,8 +2,8 @@
 # Bring-up runs of nisse-review on this development VM (Development Plan M7.3).
 #
 # It runs from the exported code under test, in a virtualenv of its own, as a
-# transient systemd unit, so it outlives the shell that started it. Its
-# container comes with M7.6.
+# transient systemd unit, so it outlives the shell that started it. It runs
+# from its image after M7.6, and on the agent host after M7.7.
 #
 #   scripts/review-bringup.sh start [REF]   export REF (default HEAD), install
 #                                           it, and start the reviewer