M1.5 accepted: the tests run over a published image

- The Dockerfile's test stage stacks on TEST_BASE: this build's agent by
  default, or a published image. It adds only the test tools (uv export
  of the dev group into the image's environment), never reinstalling the
  agent, so the suite tests the image as published.
- scripts/e2e.sh --image passes NISSE_E2E_MODEL into the container.
- The plan marks M1.5 done: v0.1.0's published image passed the whole e2e
  suite (9 of 9, 11m37s), with the release's own tests over it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

docs/Development-Plan.md

@@ -275,8 +275,9 @@ in prose, asking mid-work (L5, #42, #77).
 - Deferred: config reload without a restart (with M2.5's entry step if wanted);
   the trust dial's configuration (M3.3).
 
-**M1.5 The agent as a container image.** *Pre-approved.* **Built** (this PR);
-accepted once a tag's image passes the e2e suite.
+**M1.5 The agent as a container image.** *Pre-approved.* **Done** (#115; accepted
+2026-10-07: `v0.1.0`'s published image passed the whole e2e suite, 9 of 9, run with
+the release's own tests over it).
 - A Dockerfile for `nisse-dev`, stateless with a volume for state; a Gitea Actions
   workflow that builds it and pushes to Gitea's registry on each release tag (X4).
 - `bringup.sh` runs the image instead of a venv.
@@ -287,6 +288,10 @@ accepted once a tag's image passes the e2e suite.
   package, for `scripts/e2e.sh --image REF`. Images are built only on release:
   `release.yml` pushes `gitea.dongar.net/dev/nisse-dev:<version>` and `:latest`
   on a published release (`REGISTRY_TOKEN`, the `dev` organization's).
+- Acceptance runs the tests over a published image: `docker build --target test
+  --build-arg TEST_BASE=gitea.dongar.net/dev/nisse-dev:<version>` from the
+  release's checkout, then `scripts/e2e.sh --image`; the test stage adds only the
+  test tools, so the agent under test is the one published.
 - The live bring-up's switch to the image waits for the next live test (it needs
   its own test repository too); `bringup.sh plan` shows what it will run.