feat(pip): verify git & https access from pip container (Fixes #216)

fleet/tasks/done/002-reconcile-runbook.md.muse--runtime--roles

@@ -0,0 +1,25 @@
+# 002: Reconcile runbook
+
+Goal: future operators can run the fleet without asking.
+
+Write `docs/RUNTIME-RECONCILE.md` (under 80 lines): manifest format
+(fleet/agents.json), brief workflow (fleet/briefs/), claim protocol
+(pending/claimed/done + heartbeat touch + owner suffix), what
+`box runtime reconcile` enforces, and crash-restore behavior (dead
+server reads as all sessions missing; stale claims re-queue).
+
+Base it on the real code (bin/runtime_reconcile.py, fleet/agents.json,
+fleet/briefs/) and verify every command you document by running it.
+
+Done criteria: doc exists, is accurate, and every documented command
+was executed successfully.
+
+Result notes (append below before moving to done/):
+
+- 2026-10-07, builder muse--runtime--roles: wrote docs/RUNTIME-RECONCILE.md
+  (52 lines). Every documented command executed OK: `box runtime list
+  --socket /tmp/tmux-muse.sock --muse-only`, `box runtime reconcile`,
+  `--dry-run` (both agents ok), `--adopt` (both live, briefed), claim
+  mv + touch heartbeat. Stale-claim sweep verified on scratch queues
+  (owner-gone and 45-min-TTL paths both requeue; live+fresh claims kept).
+  Live reconcile also STARTED watchers on %20/%21. No code changes.