M7.3: nisse-review's first slice

A new package over nisse-core: it reviews every ready PR in the
repositories its account can read, and posts one COMMENT review.

- scheduler: each round, open PRs per readable repository (or the
  configured repositories); an item per PR, ready unless draft or WIP;
  closed with the PR. One review at a time, oldest first.
- reader: the repository at head and base from Gitea archives, unpacked
  and read in Python (read_file, list_files, search_code), and its issues;
  bound to the item's repository; no git, no shell.
- review: starts from the PR, commits, diff, comments, closed issues, CI;
  comment drafts a point on any existing line; post_review posts one
  COMMENT review at the head, inline where Gitea takes it, else as links in
  the summary. ask_expert; vault and memory (memory/nisse-review).
- L8: posting is an intent; recovery asks Gitea for the marked review and
  never posts twice; with Gitea down, the item waits.
- Failures retried, then said on the PR until the next push.
- Startup refuses an account that can push to or administer any repo.
- nisse-core gitea: readable_repositories, open_pull_requests, diff,
  commits, archive, issue, search_issues, reviews, post_review; PR fields.
- Bring-up: scripts/review-bringup.sh; nisse-review.example.yaml.
- Tests: unit over a fake Gitea and scripted model; a live test
  (NISSE_REVIEW_GITEA_TOKEN) reviews a PR in a fresh test repository.
- Docs: Development Plan M7.3, Tuning Guide (tuning.review.*).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

pyproject.toml

@@ -1,5 +1,5 @@
 [tool.uv.workspace]
-members = ["nisse-core", "nisse-dev", "nisse-ops"]
+members = ["nisse-core", "nisse-dev", "nisse-ops", "nisse-review"]
 
 [dependency-groups]
 dev = [
@@ -13,6 +13,7 @@ testpaths = [
     "nisse-core/tests",
     "nisse-dev/tests",
     "nisse-ops/tests",
+    "nisse-review/tests",
     "tests",
 ]
 # The seed is a test project's own code, pushed to each run's repository.
@@ -32,4 +33,4 @@ extend-exclude = ["tests/integration/seed"]  # a test project's own code
 extend-select = ["I"]
 
 [tool.ruff.lint.isort]
-known-first-party = ["nisse_core", "nisse_dev", "nisse_ops"]
+known-first-party = ["nisse_core", "nisse_dev", "nisse_ops", "nisse_review"]