M4.2: the toolchain step

The preflight becomes the toolchain step (D3, as #135 describes it): a
bounded run of the item's driver model, in a transcript of its own,
that makes the build VM and the project's files agree.

- Started by the harness when the VM isn't set up for the project
  (M4.1's checks): it sets the VM up from the repository and edits
  nothing there (no write_file; anything a command changed is reported,
  left for the work).
- Requested by the driver with toolchain_step(reason) once work is
  agreed: it installs, then brings pins, setup docs and CI
  configuration in step; its edits land in the current milestone. The
  driver gets the step's report as the tool's result, not its turns.
- D1 made structural: until the go-ahead the fast path refuses what it
  knows changes something (and anything dangerous), with a pointer to
  the restatement; unknown commands still go to the classifier, so a
  bug can be reproduced before it's restated.
- A `toolchain` actor and view; the walk asks for steps now and then.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/src/nisse_dev/loop/preflight.py

@@ -229,15 +229,16 @@ TOOLCHAIN_READY = {
     },
 }
 
-SYSTEM = """You are nisse-dev, getting a project's toolchain ready on its build VM
-before any work starts. The project is {repo}; its clone is the workspace.
+SYSTEM = """You are nisse-dev, running a toolchain step for {repo}: making its
+build VM and the project's own files agree. Its clone is the workspace.
 {workspace}
 
-Read the project's own files to work out what it needs to build, test and run:
-its language runtimes and compilers, package and build tools, and anything else
-it calls (system libraries, CLIs, a database for its tests). Honour its pins
+Work out from the project's own files what it needs to build, test and run: its
+language runtimes and compilers, package and build tools, and anything else it
+calls (system libraries, CLIs, a database for its tests). Honour its pins
 (.python-version, rust-toolchain.toml, requires-python, engines, lockfiles).
-{last}
+
+{mode}
 Check what's there with version commands; install what's missing. The build
 VM is the project's and disposable: installing on it is fine. Don't install or
 change anything for other hosts, and never install, store or ask for
@@ -252,6 +253,19 @@ found and did: each tool whose version matters with a command that prints its
 version, what you installed, and what's still missing and why. Keep it short:
 this is setup, not the work."""
 
+SETUP = """This build VM is new to the project, or was rebuilt. Set it up from what
+the repository says: its pins, setup docs and CI configuration. Don't change
+the repository's files: if they're out of step with what the project needs,
+say so in your summary, and the work can put them right.
+{last}"""
+
+REQUESTED = """The work needs a toolchain change: {reason}
+Install what it needs, then bring the project's own files in step with it: its
+pins (.python-version, rust-toolchain.toml, requires-python, engines,
+lockfiles), its setup docs (the README, or wherever it documents setup) and its
+CI configuration. Those edits are part of the current work and are reviewed
+with it."""
+
 
 def report_of(arguments: dict[str, Any]) -> Report:
     tools = [