M7.3: nisse-review's first slice

A new package over nisse-core: it reviews every ready PR in the
repositories its account can read, and posts one COMMENT review.

- scheduler: each round, open PRs per readable repository (or the
  configured repositories); an item per PR, ready unless draft or WIP;
  closed with the PR. One review at a time, oldest first.
- reader: the repository at head and base from Gitea archives, unpacked
  and read in Python (read_file, list_files, search_code), and its issues;
  bound to the item's repository; no git, no shell.
- review: starts from the PR, commits, diff, comments, closed issues, CI;
  comment drafts a point on any existing line; post_review posts one
  COMMENT review at the head, inline where Gitea takes it, else as links in
  the summary. ask_expert; vault and memory (memory/nisse-review).
- L8: posting is an intent; recovery asks Gitea for the marked review and
  never posts twice; with Gitea down, the item waits.
- Failures retried, then said on the PR until the next push.
- Startup refuses an account that can push to or administer any repo.
- nisse-core gitea: readable_repositories, open_pull_requests, diff,
  commits, archive, issue, search_issues, reviews, post_review; PR fields.
- Bring-up: scripts/review-bringup.sh; nisse-review.example.yaml.
- Tests: unit over a fake Gitea and scripted model; a live test
  (NISSE_REVIEW_GITEA_TOKEN) reviews a PR in a fresh test repository.
- Docs: Development Plan M7.3, Tuning Guide (tuning.review.*).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

nisse-review/README.md

@@ -0,0 +1,19 @@
+# nisse-review
+
+The Review Agent (Part R of the architecture): it reviews every pull request
+that is ready, in the repositories its Gitea account can read, and posts its
+review on the PR as a COMMENT review. It reads and comments; it never changes
+code, approves, or requests changes.
+
+A thin application over `nisse-core`, with its own small scheduler:
+
+- `config`: its YAML configuration (`nisse-review.example.yaml`).
+- `state`: its state store, and a review item (one per PR).
+- `scheduler`: the duty (ready PRs), one review at a time, recovery after a
+  crash.
+- `reader`: the repository at the PR's head and base, read-only, from Gitea's
+  archives: the run's executor.
+- `review`: one review run, and posting it.
+- `build`, `main`: putting it together, and the access check at startup.
+
+Bring-up on the development VM: `scripts/review-bringup.sh`.