M3.1: action classes and the fast path

Every execution tool call, the driver's and a helper's, gets a verdict
from code before it runs (P3, P4, D6).

- nisse_core.actions, nisse-core's first code: Action and Verdict, and
  reading shell commands statically, segment by segment (cd, wrappers,
  sh -c). What can't be read that way is unknown; a line is as bad as
  its worst command.
- nisse_dev.loop.actions, the rule table: reading, checks and tests are
  harmless; workspace edits, local git and installs on the build VM are
  contained; pushing, other hosts, uploads, publishing, the forge's own
  tools, deleting outside the workspace and wrecking the VM are
  dangerous; changing branches by hand is refused (the harness owns
  branches) with a pointer to the milestone tools.
- A dangerous call isn't run. The item waits on the operator with a
  question rendered from the action, and `allow` lets exactly that
  action run once. A helper can't ask, so it is refused and told to
  hand back. Unknown actions run, logged, until the classifier (M3.2).
- Every verdict is an action_verdict event, which no model sees, and an
  oplog line; `details` shows the counts and every action not simply
  run.
- The property walk gains dangerous_only_when_allowed (checked against
  a mutant that doesn't use the allow up); the slice e2e checks every
  call was judged and none needed an allow.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/src/nisse_dev/canonical.py

@@ -82,6 +82,20 @@ class Fact:
     text: str
 
 
+@dataclass(frozen=True)
+class ActionVerdict:
+    """What the fast path made of a tool call before it ran (P4, L4): a
+    record for the log, the operator and the classifier's evaluation set,
+    never shown to a model."""
+
+    call_id: str
+    tool: str
+    effect: str  # harmless | contained | unknown | dangerous | refused
+    rule: str
+    reason: str
+    decision: str  # ran | refused | asked | allowed
+
+
 @dataclass(frozen=True)
 class Compaction:
     summary: str
@@ -99,6 +113,7 @@ CanonicalEvent = (
     | DelegationStarted
     | DelegationCompleted
     | Fact
+    | ActionVerdict
     | Compaction
 )
 
@@ -112,6 +127,7 @@ EVENT_TYPES: dict[str, type] = {
     "delegation_started": DelegationStarted,
     "delegation_completed": DelegationCompleted,
     "fact": Fact,
+    "action_verdict": ActionVerdict,
     "compaction": Compaction,
 }