Let pushes go by an HTTPS token or an SSH deploy key

The push credential is either a push-only account's token, handed to git
through a credential helper that names environment variables, never
values, or a deploy key in a short-lived ssh-agent. The remote URL
follows the credential. Configured as gitea.push_user and push_token, or
gitea.push_key.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

.env.example

@@ -11,9 +11,8 @@ NISSE_LLM_TOKEN=replace-me
 NISSE_MATRIX_TOKEN=replace-me
 # gitea.token: the Gitea service account's scoped token (B2)
 NISSE_GITEA_TOKEN=replace-me
-# The sandbox repository's deploy key (write access), for the live push test:
-# the private key itself, or here, since a .env line can't hold one, its path.
-NISSE_PUSH_KEY=/root/nisse-e2e/ssh/push_sandbox
+# The live push test reads the sandbox's deploy key from the path in
+# tests/integration/nisse-test.yaml (gitea.push_key), not from here.
 
 # Where the config file is, if not ./nisse-dev.yaml. Where this file is, if
 # not ./.env, is NISSE_ENV, which has to be set in the real environment.