feat(box): passkey fetch, agent key-approval flow, unified lookups, tmux agent UX

- box passkey [show|fetch] (+ muse passkey): documents VM-only passkey
  (/srv/box/passkey.txt, fallback /etc/netvm/passkey.txt on 34.139.37.135),
  probes VM over SSH with graceful fallback; --json supported. No secrets on bl.
- approvals: request_key_approval / check_node_key_request; KEY_APPROVAL status
  surfaced in `box approvals check`; allow/deny resolve + audit to box-ctl.jsonl;
  never auto-approved. New `box approvals request-key <node> --reason`.
- box lookup (summary|fleet|threads|unread|approvals|key|docs) and docs-lookup
  engine with lookup_internal/ database (docs_internal symlink).
- muse-tmux: non-TTY attach falls back to scrollback capture; prune NameError fix.
- box/muse passthrough for tmux/muse/docs; thread list/view alias + prefix resolve.
- Docs: AGENTS.md, AGENT-TOOLING.md, BOX-WEB-SURFACE-GUIDE.md, README.
- Tests: key-approval + passkey tests; sync stale sidechat UUIDs and manifest name.
- .gitignore runtime trackers (subagent-sessions, conversation-nudge-tracker).

lookup_internal/CLI-TOOLS.md

@@ -0,0 +1,47 @@
+# CLI Tools Reference & Grammar
+
+> **Box is the main surface.** All operator work goes through Box (`box.muse-dev.online`). The web UI, `box` CLI, and agents share the same API endpoints. No UI-only powers.
+
+NetVM provides a unified command line toolchain anchored by `box` and `super` (`/usr/local/bin/box` and `/home/super/.local/bin/super`), both pointing to the off-board orchestrator script [`bin/super-cli.py`](file:///home/super/Projects/NetVM/bin/super-cli.py).
+
+---
+
+## 1. Quick Command Summary
+
+```text
+box <domain> <action> [options]
+super <domain> <action> [options]
+```
+
+| Domain | Description | Common Invocation |
+|---|---|---|
+| `fleet` | Node status, CDP ports, watch | `box fleet status` |
+| `approvals` | Browser approvals & input waits | `box approvals check -v` |
+| `dm` | Work orders, Acks, log tail | `box dm send --agent 646 --to pip ...` |
+| `thread` | Thread listings & message inspection | `box thread list` |
+| `job` | Timers, scheduled triggers, logs | `box job run box-http-health` |
+| `loop` | Loop health, open loops, nudges | `box loop status` |
+| `vars` | Dynamic runtime variables | `box vars set max_nudge_count 3` |
+| `tmux` | Headless background tmux workers | `box tmux new worker1 --command "bash"` |
+| `deploy` | Spawn subagents & pipelines | `box deploy subagent --agent 646 ...` |
+| `docs` | Internal docs, regexes, & surfaces | `box docs surfaces dashboard` |
+
+---
+
+## 2. Using `box docs` for Real-Time Lookup
+
+Autonomous agents should query the `docs` domain whenever they need schema verification, regex passing, or surface selector lookups:
+
+```bash
+# Search across all internal databases
+box docs search "work order"
+
+# Inspect assistive surfaces on box.muse-dev.online
+box docs surfaces jobs
+
+# Look up sentence grammar specifications
+box docs sentence result
+
+# Test an utterance through the regex engine
+box docs parse "[RESULT 7fce46e0] OK Finished task"
+```