feat(relay): add subagent spawn, thread tools, and container box client

- Upgrade exec-constrained.py with subagent.spawn, thread.list, thread.view, pipeline.run ops
- Grant full ops permissions to all fleet agent identities (646, pip, muse, opm)
- Implement bin/box-relay.sh zero-dependency client supporting bearer and SSH signature auth
- Add fast hybrid gateway path to dm.py for sub-2s verified deliveries
- Fix wait=0 handling in super-cli.py subagent deployments
- Add hourly check-in jobs and scheduler for 646, pip, muse
- Document agent tooling and relay APIs in docs/AGENT-TOOLING.md

bin/job-dispatch.py

@@ -261,6 +261,45 @@ def send_dm(agent, target, message, dry_run=False, followup_tags=None,
         except Exception as se:
             sys.stderr.write(f"warning: dm signing failed: {se}\n")
 
+    payload_to_send = signed_payload or message
+
+    # Try fast hybrid gateway send if target resolves to UUID
+    target_uuid = None
+    try:
+        import dm
+        target_uuid = dm.resolve_sidechat_target(target, agent)
+    except Exception:
+        pass
+
+    if target_uuid and re.fullmatch(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}", target_uuid.lower()):
+        try:
+            import muse_hybrid
+            send_node = agent if agent in ("muse", "pip", "646", "opm") else "opm"
+            res, err = muse_hybrid.send_message(send_node, payload_to_send, thread_id=target_uuid, wait=0)
+            if res and not err:
+                m_id = None
+                id_m = re.search(r"\[id:([a-f0-9]+)\]", payload_to_send)
+                if id_m:
+                    m_id = id_m.group(1)
+                log_entry = {
+                    "type": "sent",
+                    "id": m_id or (res.get("reply", {}).get("message_id") if isinstance(res, dict) else "gateway"),
+                    "agent": "opm",
+                    "to": agent,
+                    "target": target,
+                    "thread_uuid": target_uuid,
+                    "transport": "gateway",
+                    "verified": True,
+                    "ts": datetime.now(timezone.utc).isoformat()
+                }
+                dm_log_path = NETVM_ROOT / "dm-log.jsonl"
+                with open(dm_log_path, "a", encoding="utf-8") as lf:
+                    lf.write(json.dumps(log_entry) + "\n")
+                return m_id or "gateway-verified"
+            sys.stderr.write(f"warning: fast gateway send fallback: {err or res}\n")
+        except Exception as ge:
+            sys.stderr.write(f"warning: fast gateway send fallback: {ge}\n")
+
     if signed_payload:
         cmd = ([str(DM_PY), "send", "--agent", "opm", "--to", agent,
                 "--target", target, "--raw"]