implements plan: agent execution safety — QEMU guest agent gate + health guard + policy docs

I — run pre-flights QEMU guest agent before queueing VM execution
  classifyAndGate now checks vm: targets for qemu_guest_agent attribute.
  If not_running/missing, returns immediate error instead of queuing forever.

II — policy.yaml: documented host-mutation classifier rule
  Added comment clarifying that host-level package/kernel mutations
  (apt-get install, dpkg, systemctl enable) always classify as
  config_mutation and thus need operator approval.

III — health attribute read-only in update_entity_attributes
  Strips scheduler-owned keys (health, last_check_at, last_check) from
  attribute updates with a clear message directing agents to
  get_health_summary / list_checks instead.

IV — Recorded discovered dependency edges
  vm:zimaos → depends-on → lxc:nfs-export (NFS /media/library mount)
  vm:zimaos → depends-on → host:strong (NFS /media/ludo-library mount)

Also updated the run tool description to mention both guardrails.

seeds/inventory.yaml

@@ -87,10 +87,12 @@ entities:
       mesh: {netbird: {ip: 100.122.165.149, fqdn: netbird-ionos.netbird.selfhosted}}
       ssh: {user: root}
       note: netbird mgmt+signal+relay+dashboard + coturn; sshd locked to hubris pubkey
-      monitoring: none           # host unreachable from the lab (no ICMP, port 22
-                                 # times out even via hubris); liveness is covered
-                                 # by its services — authentik/matrix http checks
-                                 # and the matrix cert-expiry dial it on :443
+      monitoring: [http]          # public HTTPS probe via https://mcp.hubris.network
+                                  # (2026-08-05: was `none` — the VPS went silent for
+                                  # 7 days because nothing probed it. The standalone-server
+                                  # type inherits [ping,resource,updates] from machine, but
+                                  # SSH/ICMP don't reach it from the lab; an HTTP probe on
+                                  # the public endpoint is the reachable liveness signal).
   - slug: "ws:mac-mini"
     type: workstation
     name: mac-mini

seeds/policy.yaml

@@ -70,6 +70,11 @@ approval_rules:
   - {entity_type: docker-container, action: restart, risk_class: reversible_low, autonomy_level: auto}
   - {entity_type: machine, action: apt-upgrade, risk_class: config_mutation, autonomy_level: escalate}
   - {entity_type: machine, action: reboot, risk_class: config_mutation, autonomy_level: escalate}
+    # host-level package/kernel install (apt-get install, dpkg, modprobe, systemctl enable)
+    # always classifies as config_mutation — the classifier defaults to config_mutation
+    # for any command not in the read-only allowlist, so apt-get install reaches this
+    # tier naturally. Documented explicitly here so agents stop second-guessing:
+    # host mutations always need operator approval.
   - {entity_type: machine, action: format-disk, risk_class: destructive, autonomy_level: never}
   - {entity_type: config-repo, action: edit, risk_class: config_mutation, autonomy_level: escalate}
   - {entity_type: deploy-pipeline, action: trigger, risk_class: config_mutation, autonomy_level: escalate}