M3.3: the trust dial (the agent merges approved PRs)

A project's trust.merge is operator (the default) or approved (L3, D5,
#65). Set to approved, the harness, never the model, merges a PR in the
PR watch once an approving review from a gitea.operators account is on
its current commit, its checks pass (none at all counts; pending
waits) and it's mergeable; the item then goes on as after any merge.
Each reason to hold off (failed checks, conflicts, a refused merge) is
said once per commit.

Gitea enforces it: protection requires approvals from an operators-only
whitelist and dismisses stale ones. At start, for each approved
project, the agent checks by behaviour that its own unapproved merge is
refused, with a throwaway branch and PR made through the API (never the
workspace); if it isn't refused, the operator merges until a restart.

- gitea: approvals, combined check status, a PR's head commit and
  mergeability, API-made branches and their deletion.
- Test and bring-up repositories get the protection.
- Tests: the decision (unit), the hard wall on a real Gitea
  (test_trust_live), an e2e test where the operator only approves, and
  a walk property, merges_only_approved, checked against a mutant that
  ignores which commit was approved.

Closes #65

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev.example.yaml

@@ -29,6 +29,10 @@ projects:
     #   DATABASE_URL: {value: "${DEMO_DATABASE_URL}", visible: commands}
     #   DEPLOY_TOKEN: {value: "${DEMO_DEPLOY_TOKEN}", visible: harness}
     # egress: [pypi.org]             # beyond the default; recorded, not yet enforced
+    # trust:                         # the trust dial (L3, D5)
+    #   merge: approved              # I merge PRs an operator approved; default operator.
+    #                                # Needs protection: approvals only operators can give,
+    #                                # stale approvals dismissed, me on the merge whitelist.
 
 llm:                                  # L9: LiteLLM is the only LLM destination
   base_url: http://litellm.example:4000