nisse-core: group modules into packages by architecture section

A pure move; behaviour unchanged.

- models (L9, L7): llm, catalog, probe, render, render_anthropic, context
- log (L7, L6): canonical, views
- state (L8): store (was state), reconcile, worker, cancel, dump
- knowledge (L10, L6.4): vault, memory
- conversation (L5): transport, matrix
- execution (L13): ssh (was execution), testing
- authority (P3, P4, L4): actions
- gitea, oplog, envfile stay at the top until each gains a second module.

Every import, monkeypatch target, script and doc reference rewritten.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

docs/Development-Plan.md

@@ -312,7 +312,7 @@ the live session's fixes in #119 and #122). `nisse-dev` runs only the loop.
 
 **M3.1 Action classes and the fast path.** *Needs discussion.* **Done** (this PR).
 Harmless, contained and dangerous actions per agent (P3, D6), static fast-path rules.
-- `nisse_core.actions` (the shared part, `nisse-core`'s first code): `Action`,
+- `nisse_core.authority.actions` (the shared part, `nisse-core`'s first code): `Action`,
   `Verdict`, and reading shell commands statically, segment by segment (`cd`,
   wrappers like `sudo` and `timeout`, `sh -c`); what can't be read that way is
   unknown, and a line is as bad as its worst command.
@@ -567,7 +567,7 @@ the vault and memory, logging, `.env` loading, and the Gitea client (whole: L1
 makes Gitea every agent's tracker). `nisse-core` never imports an agent (a test
 says so).
 
-- `nisse_core.state.StateStore` holds the tables every agent has; an agent's
+- `nisse_core.state.store.StateStore` holds the tables every agent has; an agent's
   subclass adds its own tables (with their schema version and migrations), its
   model roles, and what each role is shown of the others (`views`).
   `nisse_dev.state.StateStore` adds the build VM blocks (D3); stores already at
@@ -578,6 +578,10 @@ says so).
   agent's `git`, delegation, `ask_expert`, executor tools and evaluation capture
   stay in `nisse-dev`.
 
+**Core packages.** *Done.* `nisse-core`'s modules grouped into packages by
+architecture section (`models`, `log`, `state`, `knowledge`, `conversation`,
+`execution`, `authority`), as a pure move ahead of M7.2.
+
 **M7.2 Share the loop.** *Needs discussion.* What of `nisse_dev.loop` and
 `config` is any agent's moves to `nisse-core`, shaped by what `nisse-review`
 needs; `nisse-dev` runs on it unchanged.