Add the end-to-end test, run after each milestone (M1.6)

tests/integration/test_end_to_end.py drives the whole assembled agent
(real models, the Gitea sandbox, a real build host) through a milestone
with a scripted operator, and checks what bring-up run 3 checked by hand:
a PR holding only the work, pushed with the push credential; no
credential in the clone; the planner's view carrying facts, not the
executor's turns. It cleans up after itself on the sandbox and the build
host.

scripts/e2e.sh runs it on the bring-up build VM (or --local). It has its
own marker, e2e, kept out of check.sh and CI since it spends tokens.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

scripts/e2e.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# The end-to-end test (Development Plan M1.6): the whole agent against real
+# services, driven by a scripted operator. Run after each milestone; it
+# spends model tokens and takes minutes, so it is not part of check.sh or CI.
+#
+#   scripts/e2e.sh            on the bring-up build VM (configured below)
+#   scripts/e2e.sh --local    on a throwaway local sshd instead
+#
+# Uses tests/integration/nisse-test.yaml and its secrets (.env at the repo
+# root), like the integration tests.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+if [ "${1:-}" = "--local" ]; then
+    shift
+else
+    export NISSE_E2E_BUILD_HOST=${NISSE_E2E_BUILD_HOST:-nisse-dev.garrett-hall.com}
+    export NISSE_E2E_BUILD_KEY=${NISSE_E2E_BUILD_KEY:-/root/nisse-e2e/ssh/id_ed25519}
+fi
+exec uv run pytest -m e2e -rs tests/integration/test_end_to_end.py "$@"