feat(box): passkey fetch, agent key-approval flow, unified lookups, tmux agent UX

- box passkey [show|fetch] (+ muse passkey): documents VM-only passkey
  (/srv/box/passkey.txt, fallback /etc/netvm/passkey.txt on 34.139.37.135),
  probes VM over SSH with graceful fallback; --json supported. No secrets on bl.
- approvals: request_key_approval / check_node_key_request; KEY_APPROVAL status
  surfaced in `box approvals check`; allow/deny resolve + audit to box-ctl.jsonl;
  never auto-approved. New `box approvals request-key <node> --reason`.
- box lookup (summary|fleet|threads|unread|approvals|key|docs) and docs-lookup
  engine with lookup_internal/ database (docs_internal symlink).
- muse-tmux: non-TTY attach falls back to scrollback capture; prune NameError fix.
- box/muse passthrough for tmux/muse/docs; thread list/view alias + prefix resolve.
- Docs: AGENTS.md, AGENT-TOOLING.md, BOX-WEB-SURFACE-GUIDE.md, README.
- Tests: key-approval + passkey tests; sync stale sidechat UUIDs and manifest name.
- .gitignore runtime trackers (subagent-sessions, conversation-nudge-tracker).

bin/gravity.py

@@ -632,7 +632,7 @@ def diagnose_breaks() -> list:
             if app.get("has_pending"):
                 node = app["node"]
                 is_trusted = app.get("is_trusted", False)
-                ip = app.get("ip") or "unknown target"
+                ip = app.get("target") or app.get("ip") or "unknown target"
                 breaks.append({
                     "type": "approval_blocked",
                     "severity": "WARNING" if is_trusted else "CRITICAL",
@@ -641,6 +641,16 @@ def diagnose_breaks() -> list:
                     "detail": f"Agent {node} is held up on browser approval for {ip}",
                     "remedy": f"Run 'box approvals auto' or 'box approvals allow {node}'."
                 })
+            for w in app.get("input_waits") or []:
+                node = app["node"]
+                breaks.append({
+                    "type": "input_wait",
+                    "severity": "WARNING",
+                    "component": f"node:{node}",
+                    "agent": node,
+                    "detail": f"Agent {node} task '{w.get('task')}' is waiting: {w.get('status')} ({w.get('when')})",
+                    "remedy": f"Open {node}'s task and answer it, or 'box approvals check --node {node}'."
+                })
     except Exception:
         pass
 
@@ -758,7 +768,7 @@ def remediate_breaks(dry_run=False) -> dict:
             if app.get("has_pending") and app.get("is_trusted"):
                 node = app["node"]
                 if not dry_run:
-                    approvals.allow_node_approval(node, caller="loop-remediate")
+                    approvals.allow_node_approval(node, always=True, caller="loop-remediate")
                 remediated.append({
                     "type": "approval_auto_allowed",
                     "agent": node,