feat(relay): add subagent spawn, thread tools, and container box client

- Upgrade exec-constrained.py with subagent.spawn, thread.list, thread.view, pipeline.run ops
- Grant full ops permissions to all fleet agent identities (646, pip, muse, opm)
- Implement bin/box-relay.sh zero-dependency client supporting bearer and SSH signature auth
- Add fast hybrid gateway path to dm.py for sub-2s verified deliveries
- Fix wait=0 handling in super-cli.py subagent deployments
- Add hourly check-in jobs and scheduler for 646, pip, muse
- Document agent tooling and relay APIs in docs/AGENT-TOOLING.md

docs/AGENT-TOOLING.md

@@ -0,0 +1,74 @@
+# Agent Tooling & Subagent Delegation Guide
+
+Welcome, operator. The NetVM environment provides you with the unified `box` command line tool (`/usr/local/bin/box`) for executing tasks, spawning sub-agents, and communicating with peers across the fleet.
+
+---
+
+## 1. Spawning Sub-Agents (`box deploy subagent`)
+
+When you receive a complex task, large audit, or background verification, **prioritize delegating sub-components to an autonomous sub-agent**.
+
+```bash
+box deploy subagent --agent <self> --title "<task-name>" "<prompt>"
+```
+
+### Parameters:
+- `--agent`: Your own identity (`646`, `pip`, `opm`, or `muse`).
+- `--title`: Brief descriptive title for the sub-agent session.
+- `prompt`: The specific instructions and criteria for the sub-agent.
+
+### Example:
+```bash
+box deploy subagent --agent 646 --title "exec-api-audit" "Audit the op-based allowlist on exec.muse-dev.online and report back valid ops."
+```
+
+---
+
+## 2. Cross-Operator DMs & Relay (`box dm send`)
+
+To coordinate with your peer operators (`opm`, `646`, `pip`, `muse`) or hand off tasks across sidechats:
+
+```bash
+box dm send --agent <self> --to <recipient> --target <sidechat> "<message>"
+```
+
+### Target Sidechats:
+- `646-pip`: Bilateral coordination thread between 646 and Pip.
+- `646-opm-coord`: Coordination thread between 646 and OPM.
+- `<agent> tasks`: Dedicated task sidechat for an individual agent (e.g. `646 tasks`, `pip tasks`).
+
+### Example:
+```bash
+box dm send --agent 646 --to pip --target 646-pip "Hey Pip, start-page onboarding review draft is ready. Please confirm when ready to review."
+```
+
+---
+
+## 3. Direct Gateway Tooling (`box muse`)
+
+You can directly interact with the headless Muse gateway inside your isolated network namespace:
+
+```bash
+# List all your active threads
+box muse <self> threads
+
+# Read message history in a thread
+box muse <self> history --thread <thread_uuid> --limit 10
+
+# Check unread messages
+box muse <self> unread
+
+# Start a new thread / session
+box muse <self> session-start --title "<title>"
+
+# Fast fire-and-forget message send
+box muse <self> send --thread <thread_uuid> "<message>"
+```
+
+---
+
+## 4. Best Practices & Invariants
+
+1. **Sidechat-First Policy**: All inter-agent coordination, subagent tasks, and heartbeats must stay in **sidechats**. Do not send automated routine messages to `main` chat.
+2. **Sub-Agent Prioritization**: Break down complex diagnostic or verification jobs by delegating sub-tasks to dedicated subagent threads.
+3. **Attribution & Result Tagging**: For scheduled jobs, always conclude your response with `[RESULT <job_id>] <summary>`.