M3.3: the trust dial (the agent merges approved PRs)

A project's trust.merge is operator (the default) or approved (L3, D5,
#65). Set to approved, the harness, never the model, merges a PR in the
PR watch once an approving review from a gitea.operators account is on
its current commit, its checks pass (none at all counts; pending
waits) and it's mergeable; the item then goes on as after any merge.
Each reason to hold off (failed checks, conflicts, a refused merge) is
said once per commit.

Gitea enforces it: protection requires approvals from an operators-only
whitelist and dismisses stale ones. At start, for each approved
project, the agent checks by behaviour that its own unapproved merge is
refused, with a throwaway branch and PR made through the API (never the
workspace); if it isn't refused, the operator merges until a restart.

- gitea: approvals, combined check status, a PR's head commit and
  mergeability, API-made branches and their deletion.
- Test and bring-up repositories get the protection.
- Tests: the decision (unit), the hard wall on a real Gitea
  (test_trust_live), an e2e test where the operator only approves, and
  a walk property, merges_only_approved, checked against a mutant that
  ignores which commit was approved.

Closes #65

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

tests/integration/e2e_support.py

@@ -138,13 +138,20 @@ def make_repo(
             "POST",
             f"/repos/{full}/branch_protections",
             # Pushes only by the operator (who sets up fixtures, as an owner
-            # can); the agent's are refused, and merging needs an approval.
+            # can); the agent's are refused. Merging needs an approval only
+            # the operator can give, on the PR as it is now (D5, M3.3): the
+            # agent may merge once it has one.
             json={
                 "branch_name": "main",
                 "enable_push": True,
                 "enable_push_whitelist": True,
                 "push_whitelist_usernames": [OWNER],
                 "required_approvals": 1,
+                "enable_approvals_whitelist": True,
+                "approvals_whitelist_username": [OWNER],
+                "dismiss_stale_approvals": True,
+                "enable_merge_whitelist": True,
+                "merge_whitelist_usernames": [OWNER, agent],
             },
         )
         # The labels the agent reads (D1), as a project would have them.