Keep credentials out of reprs; count only live ssh-agents in tests

A failing CI test printed a test key through SSHKey's default repr. Push
credentials, AgentConfig's tokens and MatrixConfig's token are now
excluded from their reprs, so no failure or log line can print them. In
CI's container killed ssh-agents linger as zombies, so the tests count
only live ones.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/src/nisse_dev/config.py

@@ -233,12 +233,14 @@ class AgentConfig:
     workspace: Path
     project: str
     llm_base_url: str
-    llm_token: str
+    # Credentials never appear in a repr: a failing test or a log line
+    # would print them.
+    llm_token: str = field(repr=False)
     roles: RoleMap
     matrix: MatrixConfig
     operators: frozenset[str]
     gitea_url: str
-    gitea_token: str
+    gitea_token: str = field(repr=False)
     gitea_repo: str
     gitea_operators: frozenset[str]
     build_host: BuildHost
@@ -248,7 +250,7 @@ class AgentConfig:
     # (push_user, push_token), or the path to a deploy key (push_key).
     push_key: Path | None = None
     push_user: str | None = None
-    push_token: str | None = None
+    push_token: str | None = field(default=None, repr=False)
     max_output_tokens: int = DEFAULT_MAX_OUTPUT_TOKENS
     request_timeout_s: float = DEFAULT_REQUEST_TIMEOUT_S
     tuning: Tuning = field(default_factory=Tuning)

nisse-dev/src/nisse_dev/git.py

@@ -18,7 +18,7 @@ Pull requests are opened from the agent's own host with its Gitea API token
 """
 
 import shlex
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from pathlib import Path
 
 from nisse_dev.execution import HostUnavailable, SSHHost
@@ -67,14 +67,15 @@ class HTTPSToken:
     """A push-only account's token, for HTTPS remotes (D4)."""
 
     username: str
-    token: str
+    # Never in a repr: a failing test or a log line would print it.
+    token: str = field(repr=False)
 
 
 @dataclass(frozen=True)
 class SSHKey:
     """A deploy key's private half, for SSH remotes (D4)."""
 
-    private_key: str
+    private_key: str = field(repr=False)
 
 
 PushCredential = HTTPSToken | SSHKey

nisse-dev/src/nisse_dev/matrix.py

@@ -16,7 +16,7 @@ import re
 import threading
 import uuid
 from collections.abc import Callable
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from urllib.parse import unquote
 
 import httpx
@@ -40,7 +40,7 @@ class TransportError(RuntimeError):
 class MatrixConfig:
     homeserver: str
     user_id: str
-    token: str
+    token: str = field(repr=False)  # never in a repr or a log line
     room_id: str