M7.3: nisse-review's first slice

A new package over nisse-core: it reviews every ready PR in the
repositories its account can read, and posts one COMMENT review.

- scheduler: each round, open PRs per readable repository (or the
  configured repositories); an item per PR, ready unless draft or WIP;
  closed with the PR. One review at a time, oldest first.
- reader: the repository at head and base from Gitea archives, unpacked
  and read in Python (read_file, list_files, search_code), and its issues;
  bound to the item's repository; no git, no shell.
- review: starts from the PR, commits, diff, comments, closed issues, CI;
  comment drafts a point on any existing line; post_review posts one
  COMMENT review at the head, inline where Gitea takes it, else as links in
  the summary. ask_expert; vault and memory (memory/nisse-review).
- L8: posting is an intent; recovery asks Gitea for the marked review and
  never posts twice; with Gitea down, the item waits.
- Failures retried, then said on the PR until the next push.
- Startup refuses an account that can push to or administer any repo.
- nisse-core gitea: readable_repositories, open_pull_requests, diff,
  commits, archive, issue, search_issues, reviews, post_review; PR fields.
- Bring-up: scripts/review-bringup.sh; nisse-review.example.yaml.
- Tests: unit over a fake Gitea and scripted model; a live test
  (NISSE_REVIEW_GITEA_TOKEN) reviews a PR in a fresh test repository.
- Docs: Development Plan M7.3, Tuning Guide (tuning.review.*).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

scripts/review-bringup.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Bring-up runs of nisse-review on this development VM (Development Plan M7.3).
+#
+# It runs from the exported code under test, in a virtualenv of its own, as a
+# transient systemd unit, so it outlives the shell that started it. Its
+# container comes with M7.6.
+#
+#   scripts/review-bringup.sh start [REF]   export REF (default HEAD), install
+#                                           it, and start the reviewer
+#   scripts/review-bringup.sh stop          stop it cleanly (SIGTERM)
+#   scripts/review-bringup.sh status        the unit, and its items
+#   scripts/review-bringup.sh logs          follow its log
+#
+# Layout, under $REVIEW (default /root/nisse-review):
+#   nisse-review.yaml, .env   the config and its secrets (made by hand once)
+#   code/, venv/              the exported code and its install
+#   state.db, scratch/        its state, and repository trees while reviewing
+#   vault/                    its memory (memory/nisse-review)
+set -euo pipefail
+
+REVIEW=${NISSE_REVIEW:-/root/nisse-review}
+SRC=${NISSE_SRC:-/root/nisse}
+UNIT=nisse-review-bringup
+export PATH="$HOME/.local/bin:$PATH"
+
+die() { echo "review-bringup: $*" >&2; exit 1; }
+running() { systemctl is-active --quiet "$UNIT"; }
+
+cmd_start() {
+    local ref=${1:-HEAD} sha
+    [ -f "$REVIEW/nisse-review.yaml" ] && [ -f "$REVIEW/.env" ] || die "no config in $REVIEW"
+    running && die "already running; stop it first"
+    sha=$(git -C "$SRC" rev-parse --verify "$ref^{commit}") || die "unknown ref $ref"
+    rm -rf "$REVIEW/code" && mkdir -p "$REVIEW/code" "$REVIEW/vault/memory/nisse-review"
+    git -C "$SRC" archive "$sha" | tar -x -C "$REVIEW/code"
+    UV_PROJECT_ENVIRONMENT="$REVIEW/venv" uv sync -q --frozen --no-dev \
+        --package nisse-review --no-editable --project "$REVIEW/code"
+    echo "$sha" > "$REVIEW/run-info"
+    systemd-run --unit="$UNIT" --collect \
+        -p WorkingDirectory="$REVIEW" \
+        -E NISSE_CONFIG="$REVIEW/nisse-review.yaml" -E NISSE_ENV="$REVIEW/.env" \
+        "$REVIEW/venv/bin/nisse-review"
+    echo "started $UNIT at $sha"
+}
+
+cmd_stop() { running && systemctl stop "$UNIT" || echo "not running"; }
+
+cmd_status() {
+    systemctl status "$UNIT" --no-pager || true
+    [ -f "$REVIEW/state.db" ] && sqlite3 "$REVIEW/state.db" \
+        "SELECT id, position, status, outcome FROM work_items ORDER BY opened_at"
+}
+
+cmd_logs() { journalctl -u "$UNIT" -f; }
+
+case "${1:-}" in
+    start) shift; cmd_start "$@" ;;
+    stop) cmd_stop ;;
+    status) cmd_status ;;
+    logs) cmd_logs ;;
+    *) die "usage: $0 start [REF] | stop | status | logs" ;;
+esac