feat(relay): add subagent spawn, thread tools, and container box client

- Upgrade exec-constrained.py with subagent.spawn, thread.list, thread.view, pipeline.run ops
- Grant full ops permissions to all fleet agent identities (646, pip, muse, opm)
- Implement bin/box-relay.sh zero-dependency client supporting bearer and SSH signature auth
- Add fast hybrid gateway path to dm.py for sub-2s verified deliveries
- Fix wait=0 handling in super-cli.py subagent deployments
- Add hourly check-in jobs and scheduler for 646, pip, muse
- Document agent tooling and relay APIs in docs/AGENT-TOOLING.md

jobs/pip-hourly-checkin.json

@@ -0,0 +1,17 @@
+{
+  "name": "pip-hourly-checkin",
+  "description": "Hourly operational check-in for Pip during active daytime hours",
+  "agent": "pip",
+  "schedule": "0 8-22 * * *",
+  "timeout": 300,
+  "on_failure": "alert",
+  "dm_target": "pip tasks",
+  "sidechat": {"create": false},
+  "followup": {
+    "expect_reply": true,
+    "timeout": "1h",
+    "nudges": 1,
+    "escalate": "opm"
+  },
+  "prompt_template": "Hourly operational check-in for Pip.\nJob ID: {job_id}\nTime: {datetime}\n\nPlease report briefly in this thread:\n(1) Current tasks and workspace status\n(2) Blockers (start-page draft, authorization, or netns items)\n(3) Readiness / next steps\n\nReply with [RESULT {job_id}] and your status."
+}