implements plan: agent execution safety — QEMU guest agent gate + health guard + policy docs

I — run pre-flights QEMU guest agent before queueing VM execution
  classifyAndGate now checks vm: targets for qemu_guest_agent attribute.
  If not_running/missing, returns immediate error instead of queuing forever.

II — policy.yaml: documented host-mutation classifier rule
  Added comment clarifying that host-level package/kernel mutations
  (apt-get install, dpkg, systemctl enable) always classify as
  config_mutation and thus need operator approval.

III — health attribute read-only in update_entity_attributes
  Strips scheduler-owned keys (health, last_check_at, last_check) from
  attribute updates with a clear message directing agents to
  get_health_summary / list_checks instead.

IV — Recorded discovered dependency edges
  vm:zimaos → depends-on → lxc:nfs-export (NFS /media/library mount)
  vm:zimaos → depends-on → host:strong (NFS /media/ludo-library mount)

Also updated the run tool description to mention both guardrails.

seeds/policy.yaml

@@ -70,6 +70,11 @@ approval_rules:
   - {entity_type: docker-container, action: restart, risk_class: reversible_low, autonomy_level: auto}
   - {entity_type: machine, action: apt-upgrade, risk_class: config_mutation, autonomy_level: escalate}
   - {entity_type: machine, action: reboot, risk_class: config_mutation, autonomy_level: escalate}
+    # host-level package/kernel install (apt-get install, dpkg, modprobe, systemctl enable)
+    # always classifies as config_mutation — the classifier defaults to config_mutation
+    # for any command not in the read-only allowlist, so apt-get install reaches this
+    # tier naturally. Documented explicitly here so agents stop second-guessing:
+    # host mutations always need operator approval.
   - {entity_type: machine, action: format-disk, risk_class: destructive, autonomy_level: never}
   - {entity_type: config-repo, action: edit, risk_class: config_mutation, autonomy_level: escalate}
   - {entity_type: deploy-pipeline, action: trigger, risk_class: config_mutation, autonomy_level: escalate}