M3.1: action classes and the fast path

Every execution tool call, the driver's and a helper's, gets a verdict
from code before it runs (P3, P4, D6).

- nisse_core.actions, nisse-core's first code: Action and Verdict, and
  reading shell commands statically, segment by segment (cd, wrappers,
  sh -c). What can't be read that way is unknown; a line is as bad as
  its worst command.
- nisse_dev.loop.actions, the rule table: reading, checks and tests are
  harmless; workspace edits, local git and installs on the build VM are
  contained; pushing, other hosts, uploads, publishing, the forge's own
  tools, deleting outside the workspace and wrecking the VM are
  dangerous; changing branches by hand is refused (the harness owns
  branches) with a pointer to the milestone tools.
- A dangerous call isn't run. The item waits on the operator with a
  question rendered from the action, and `allow` lets exactly that
  action run once. A helper can't ask, so it is refused and told to
  hand back. Unknown actions run, logged, until the classifier (M3.2).
- Every verdict is an action_verdict event, which no model sees, and an
  oplog line; `details` shows the counts and every action not simply
  run.
- The property walk gains dangerous_only_when_allowed (checked against
  a mutant that doesn't use the allow up); the slice e2e checks every
  call was judged and none needed an allow.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

tests/integration/test_end_to_end_loop.py

@@ -31,6 +31,7 @@ from e2e_support import (
     task,
 )
 
+from nisse_dev.canonical import ActionVerdict
 from nisse_dev.config import AgentConfig, LoopTuning
 from nisse_dev.execution import SSHHost
 from nisse_dev.gitea import GiteaClient, GiteaError
@@ -294,6 +295,18 @@ def test_the_slice_end_to_end(
 
         # --- the operator approves and merges; the agent closes the item ---
         operator.merge_and_close(issue)
+
+        # --- M3.1: the fast path judged every call; none needed an allow ---
+        store = agent.store
+
+        def verdicts() -> list[ActionVerdict]:
+            [done] = [i for i in store.work_items() if loop_of(i).issue == issue]
+            events = store.transcript(done.id, "orchestrator").read()
+            return [e.event for e in events if isinstance(e.event, ActionVerdict)]
+
+        judged = agent.worker.call(verdicts)
+        assert judged, "no verdicts were recorded"
+        assert not [v for v in judged if v.decision == "asked"], judged
     finally:
         operator.tidy([issue] if issue is not None else [], [pr] if pr else [])