feat(pip): verify git & https access from pip container (Fixes #216)

fleet/tasks/done/005-reconcile-dryrun.md.muse--runtime--roles

@@ -0,0 +1,24 @@
+# 005: Reconcile dry-run sanity
+
+Goal: prove `box runtime reconcile` is a no-op on a healthy fleet.
+
+Steps:
+1. Run `box runtime reconcile --socket /tmp/tmux-muse.sock --dry-run`.
+2. Record the per-agent verdicts (ok / would-change).
+3. If it would change anything, do not apply; document what and why
+   it looks wrong.
+
+Done criteria: dry-run output captured in the result notes below,
+with either "all ok, no changes proposed" or a precise list of
+proposed changes.
+
+Result notes (append below before moving to done/):
+
+- 2026-10-07, builder muse--runtime--roles: task step 1's
+  `--socket /tmp/tmux-muse.sock` flag is rejected
+  ("unrecognized arguments"); ran documented
+  `box runtime reconcile --dry-run` instead. Output:
+    === RUNTIME RECONCILE (dry-run) ===
+    • ok muse--runtime--roles [builder]: live (working)
+    • ok muse--runtime--operator [operator]: live, briefed
+  Verdict: all ok, no changes proposed. Nothing applied.