M1.5 accepted: the tests run over a published image

- The Dockerfile's test stage stacks on TEST_BASE: this build's agent by
  default, or a published image. It adds only the test tools (uv export
  of the dev group into the image's environment), never reinstalling the
  agent, so the suite tests the image as published.
- scripts/e2e.sh --image passes NISSE_E2E_MODEL into the container.
- The plan marks M1.5 done: v0.1.0's published image passed the whole e2e
  suite (9 of 9, 11m37s), with the release's own tests over it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

Dockerfile

@@ -10,6 +10,12 @@
 #   docker build -t nisse-dev .                  the agent
 #   docker build --target test -t nisse-dev:test .   plus the tests, for
 #                                                   scripts/e2e.sh --image
+#   docker build --target test --build-arg TEST_BASE=<published image> \
+#       -t nisse-dev:test .                      the tests over a release as
+#                                                published (M1.5 acceptance)
+
+# What the test stage stacks on: this build's agent, or a published image.
+ARG TEST_BASE=runtime
 
 FROM python:3.12-slim AS build
 COPY --from=ghcr.io/astral-sh/uv:0.12.10 /uv /usr/local/bin/uv
@@ -40,9 +46,10 @@ VOLUME /var/lib/nisse-dev
 USER nisse
 ENTRYPOINT ["nisse-dev"]
 
-# The image's own package plus the tests, so the end-to-end suite runs
-# against what was built, not the source tree.
-FROM runtime AS test
+# The tests over an image's own package (this build's, or a published one,
+# TEST_BASE): only the test tools are added, never the agent reinstalled, so
+# the end-to-end suite runs against what was built, not the source beside it.
+FROM ${TEST_BASE} AS test
 USER root
 RUN apt-get update \
     && apt-get install -y --no-install-recommends git openssh-server \
@@ -57,11 +64,9 @@ COPY nisse-ops nisse-ops
 COPY tests tests
 COPY scripts scripts
 COPY conftest.py ./
-ENV UV_PROJECT_ENVIRONMENT=/opt/nisse
-# Test tools too, all installed (not editable), and `uv run` never re-syncs:
-# the tests import the package as built, not the source tree beside them.
-RUN uv sync --frozen --all-packages --no-editable --inexact
-ENV UV_NO_SYNC=1
+ENV UV_PROJECT_ENVIRONMENT=/opt/nisse UV_NO_SYNC=1
+RUN uv export --frozen --only-group dev --no-hashes --no-emit-project > /tmp/dev.txt \
+    && uv pip install --quiet --python /opt/nisse/bin/python -r /tmp/dev.txt
 ENTRYPOINT []
 
 # The default target: the agent itself.