nisse-review: a stop ends a review in progress; quieter repo failures

SIGTERM used to stop only new rounds: a review in progress ran on until
systemd killed it 90s later. Now the scheduler's stop sets the driver's
cancel flag, so the run ends at its next turn, and a model call in flight
is broken off (Interruptible, raising Stopped from the signal handler, only
ever inside a model call). The item goes back to ready, with nothing
drafted posted and no failure counted; replies already posted carry their
markers and are not repeated.

intake.repo_failed is logged when a repository starts failing or the reason
changes, and intake.repo_ok when it lists again, not every round.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

docs/Architecture.md

@@ -962,7 +962,10 @@ Two agents can argue forever, so a PR's exchanges are capped.
   room, it gets one too. Until then the operator stops it on a PR by commenting
   `stop` there (a review is asked for again with `review`: a fresh one of the
   whole PR, with the round count reset), and stops it entirely by stopping its
-  container. A command is an operator's whole top-level comment, acknowledged
+  container. Stopping it ends a review in progress at once: at its next turn,
+  or by breaking off the model call it is waiting on. Nothing drafted is
+  posted, and the PR is reviewed again when it starts, with no failure
+  counted. A command is an operator's whole top-level comment, acknowledged
   with a reaction rather than a comment the PR's author would have to answer.
 - **Its own identity** (L12): a Gitea account (`nisse-review`) with read access to
   the repositories it reviews, its own token and LiteLLM key, and its own

docs/Development-Plan.md

@@ -694,6 +694,11 @@ of earlier points, replies on threads, the round cap and its reset, `stop` and
 - **Tests:** `test_review_rounds.py`, including a no-dead-end walk over every
   position; the live smoke test adds a push and a question, and checks the
   later review at the new head.
+- **Follow-ups:** a stop (SIGTERM) ends a review in progress at its next turn,
+  or breaks off its model call (`Interruptible`, `nisse_core.models`), and the
+  PR goes back to ready with no failure counted; a repository Gitea won't
+  list is logged when that starts or changes (`intake.repo_failed`), and when
+  it ends (`intake.repo_ok`), not every round. Tests: `test_review_stop.py`.
 
 **M7.6 Deployment.** *Waits for the agent host (Phase 6).* Its image, container,
 Gitea account and secrets (R5).