feat(pip): verify git & https access from pip container (Fixes #216)

fleet/tasks/done/015-pip-approval-triage.md.muse--runtime--roles

@@ -0,0 +1,21 @@
+# 015: Pip approval triage (read-only)
+
+Goal: detail the pip PENDING approval found in 014 (no driving).
+
+Steps:
+1. Re-run `box approvals check` and record pip's pending item.
+2. If it names a thread/sidechat, view its recent messages with
+   `box thread view pip <thread_id> --limit 10`.
+3. Never answer, approve, or type into any prompt; report only.
+
+Done criteria: result notes below describe the pending item
+(what it asks, where it waits) or state it cleared.
+
+Result notes (append below before moving to done/):
+
+- 2026-10-07, builder muse--runtime--roles (read-only, drove nothing):
+  pip still PENDING — "Allow operator-pip to connect to true over SSH
+  for Heartbeat?" (scheduled task Heartbeat, 1 queued task awaiting
+  review, UNTRUSTED). It names no thread/sidechat; `box thread list
+  pip` shows 0 threads, so no messages to view. Approval waits in
+  pip's browser approval surface; needs operator allow/deny.