feat(relay): add subagent spawn, thread tools, and container box client

- Upgrade exec-constrained.py with subagent.spawn, thread.list, thread.view, pipeline.run ops
- Grant full ops permissions to all fleet agent identities (646, pip, muse, opm)
- Implement bin/box-relay.sh zero-dependency client supporting bearer and SSH signature auth
- Add fast hybrid gateway path to dm.py for sub-2s verified deliveries
- Fix wait=0 handling in super-cli.py subagent deployments
- Add hourly check-in jobs and scheduler for 646, pip, muse
- Document agent tooling and relay APIs in docs/AGENT-TOOLING.md

bin/pipeline_engine.py

@@ -55,6 +55,39 @@ def create_pipeline(pipeline_name, run_id=None, custom_target=None):
     data = load_pipelines()
     target = custom_target or f"pipe-{run_id.split('-')[-1]}"
 
+    # Fast headless gateway provisioning: create session server-side
+    thread_uuid = None
+    job_file = JOBS_DIR / f"{pipeline_name}.json"
+    root_agent = "opm"
+    if job_file.exists():
+        try:
+            with open(job_file) as f:
+                root_agent = json.load(f).get("agent", "opm")
+        except Exception:
+            pass
+
+    try:
+        import muse_hybrid
+        res, err = muse_hybrid.start_session(root_agent, title=target)
+        if res and not err:
+            thread_uuid = res.get("session_id")
+            # Register in job-sidechats.json so dm.py resolves it immediately
+            sc_file = NETVM_ROOT / "job-sidechats.json"
+            if sc_file.exists():
+                with open(sc_file, "r", encoding="utf-8") as f:
+                    sc_data = json.load(f)
+                sc_data[target] = {
+                    "thread_uuid": thread_uuid,
+                    "agent": root_agent,
+                    "created_at": utcnow()
+                }
+                tmp_sc = f"{sc_file}.tmp.{os.getpid()}"
+                with open(tmp_sc, "w", encoding="utf-8") as f:
+                    json.dump(sc_data, f, indent=2)
+                os.replace(tmp_sc, sc_file)
+    except Exception as e:
+        sys.stderr.write(f"warning: fast gateway session creation failed: {e}\n")
+
     entry = {
         "run_id": run_id,
         "pipeline_name": pipeline_name,
@@ -62,7 +95,7 @@ def create_pipeline(pipeline_name, run_id=None, custom_target=None):
         "updated_at": utcnow(),
         "status": "running",
         "target": target,
-        "thread_uuid": None,
+        "thread_uuid": thread_uuid,
         "current_step": 1,
         "steps": [],
     }