Move configuration to a YAML file, and make the tuning knobs configurable

The thresholds Part H says to tune on the real inference hardware were
hardcoded, so every adjustment would have been a PR. They now live in a
`tuning:` section of a YAML config file, which also replaces flat
environment variables as the home for structure (#32).

- The file (NISSE_CONFIG, default ./nisse-dev.yaml) carries structure
  and holds no secrets: credentials are ${VAR} references resolved from
  the environment, and a reference to an unset variable is an error
- The environment still wins: every existing NISSE_* variable overrides
  its key, and the file is optional, so .env and CI work unchanged
- Validation stays fail-fast and reports every problem at once; unknown
  keys are errors, so a misspelt knob fails at startup instead of
  silently doing nothing
- The config file joins the state store and .env in the check that
  refuses to start when they sit inside the workspace clone
- Tuning covers the executor's turn and failure limits, the consult
  budget, the delegation caps, the command timeout and the tool output
  limit, which Workspace now takes as a setting; the defaults are the
  values the agent already ran with
- llm.max_output_tokens reaches both LLM clients from the config

docs/Tuning-Guide.md explains the knobs for someone learning local
model tuning: how weights, quantization and the KV cache spend VRAM,
what each knob does and what goes wrong at either extreme, and an order
to tune in. nisse-dev.example.yaml documents every key and is checked
by a test so it cannot drift.

Closes #32

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.env.example

@@ -1,5 +1,10 @@
 # Copy to .env (chmod 600). Real environment variables win over this file.
 # .env is gitignored; never commit real values.
+#
+# Settings can also live in a YAML file (nisse-dev.example.yaml), which keeps
+# structure and the tuning knobs; secrets stay here and are referenced from
+# the file as ${NISSE_LLM_TOKEN} and so on. Every variable below overrides the
+# matching key in that file.
 
 # --- LLM access (A5): the LiteLLM proxy is the single LLM destination ---
 NISSE_LLM_BASE_URL=http://litellm.example:4000