feat(pip): verify git & https access from pip container (Fixes #216)

fleet/tasks/done/003-watcher-health.md.muse--runtime--roles

@@ -0,0 +1,22 @@
+# 003: Watcher health check
+
+Goal: confirm every fleet pane has approval coverage.
+
+Steps:
+1. Run `box runtime list --socket /tmp/tmux-muse.sock --muse-only`.
+2. For each pane: record STATE and WATCHER columns.
+3. If any pane lacks a watcher, run `box runtime reconcile
+   --socket /tmp/tmux-muse.sock` (or the documented watcher-start
+   path in docs/RUNTIME-RECONCILE.md) and re-check.
+
+Done criteria: every live pane shows a watcher, or this file
+lists which pane lacks one and why it could not be started.
+
+Result notes (append below before moving to done/):
+
+- 2026-10-07, builder muse--runtime--roles: initial list showed %21
+  (open-prompt, WATCHER -) and %20 (working, WATCHER -) — no coverage.
+  Note: task step 3's `box runtime reconcile --socket ...` flag does not
+  exist; used documented `box runtime reconcile` instead → STARTED
+  watchers on %21+%20. Re-check: %21 open-prompt ALIVE 14, %20 working
+  ALIVE 21. Every live pane covered. Done criteria met.