feat(box): passkey fetch, agent key-approval flow, unified lookups, tmux agent UX

- box passkey [show|fetch] (+ muse passkey): documents VM-only passkey
  (/srv/box/passkey.txt, fallback /etc/netvm/passkey.txt on 34.139.37.135),
  probes VM over SSH with graceful fallback; --json supported. No secrets on bl.
- approvals: request_key_approval / check_node_key_request; KEY_APPROVAL status
  surfaced in `box approvals check`; allow/deny resolve + audit to box-ctl.jsonl;
  never auto-approved. New `box approvals request-key <node> --reason`.
- box lookup (summary|fleet|threads|unread|approvals|key|docs) and docs-lookup
  engine with lookup_internal/ database (docs_internal symlink).
- muse-tmux: non-TTY attach falls back to scrollback capture; prune NameError fix.
- box/muse passthrough for tmux/muse/docs; thread list/view alias + prefix resolve.
- Docs: AGENTS.md, AGENT-TOOLING.md, BOX-WEB-SURFACE-GUIDE.md, README.
- Tests: key-approval + passkey tests; sync stale sidechat UUIDs and manifest name.
- .gitignore runtime trackers (subagent-sessions, conversation-nudge-tracker).

lookup_internal/fleet_nodes.json

@@ -0,0 +1,61 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Fleet Topology & Agent Identities",
+  "version": "1.0.0",
+  "nodes": {
+    "muse": {
+      "identity": "muse",
+      "netns": "warp-muse",
+      "egress_ip": "Dedicated Stable Colo IP (WARP)",
+      "cdp_port": 9410,
+      "peer_ip": "10.201.35.2",
+      "default_sidechat": "muse tasks",
+      "role": "General agent, primary chat evaluation"
+    },
+    "pip": {
+      "identity": "pip",
+      "netns": "warp-pip",
+      "egress_ip": "Dedicated Stable Colo IP (WARP)",
+      "cdp_port": 9411,
+      "peer_ip": "10.201.35.3",
+      "default_sidechat": "646-pip-coord",
+      "role": "Pipeline driver, account management"
+    },
+    "646": {
+      "identity": "646",
+      "netns": "warp-646",
+      "egress_ip": "Dedicated Stable Colo IP (WARP)",
+      "cdp_port": 9412,
+      "peer_ip": "10.201.35.4",
+      "default_sidechat": "646 tasks",
+      "role": "Operator-646, code execution, bridge management"
+    },
+    "opm": {
+      "identity": "opm",
+      "netns": "warp-opm",
+      "egress_ip": "Dedicated Stable Colo IP (WARP)",
+      "cdp_port": 9413,
+      "peer_ip": "10.201.35.5",
+      "default_sidechat": "heartbeat",
+      "role": "Operator-main, supervisor, telemetry check"
+    },
+    "dev": {
+      "identity": "dev",
+      "netns": "warp-dev",
+      "egress_ip": "Staging WARP egress",
+      "cdp_port": 9414,
+      "peer_ip": "10.201.35.6",
+      "default_sidechat": "dev tasks",
+      "role": "Development and experimental features"
+    },
+    "def": {
+      "identity": "def",
+      "netns": "warp-def",
+      "egress_ip": "Default fallback egress",
+      "cdp_port": 9415,
+      "peer_ip": "10.201.35.7",
+      "default_sidechat": "default",
+      "role": "Fallback routing node"
+    }
+  }
+}