feat(observability): restore monitoring coverage, make gaps visible, stream executions

Monitoring coverage was 3 of 89 active entities. Three bugs, each hidden by
discarded errors in checkdefaults:

- writeCheck generated a fresh uuid, inserted the check entity ON CONFLICT
  (slug) DO NOTHING, then wrote a check_defs row referencing it. On any
  re-seed the slug already existed, the entity insert no-oped, and the FK
  violated — aborting the ingest transaction and surfacing as an unrelated
  failure several entities later. Re-seeding has been broken since; prod's
  coverage was frozen at its first successful seed. This is what
  TestSeedIngestIdempotentAndNoDuplicateEdges had been reporting.
- shortSlug truncated to the last 8 chars, so all 21 ingress routes collapsed
  to ".network" and overwrote each other; service:jellyfin collided with
  lxc:jellyfin.
- The ssh-script checker never read the `args` config checkdefaults wrote, so
  process_check.sh always ran without its unit name and returned "unknown".

Coverage is now 75/89. Monitoring is declared per entity type in
seeds/ontology.yaml and resolved through the is-a hierarchy, so a type can say
it warrants nothing (site, lan, mesh, cluster) and never be reported as a gap.
coverageSweep raises an `unmonitored` signal only where a type declares
monitoring it lacks — 8 real gaps, no false positives.

Also:
- entity_types.attribute_schema was never ingested: the seed loader read
  "attribute_schema" but the YAML says "attributes", so all 60 types stored
  JSON null.
- ListExecutions ignored its declared target/action/correlation_id filters and
  paginated on a non-unique target slug, dropping and repeating rows.
- started_at was captured but only written at terminal state, so a running
  execution reported NULL for its whole life. The three MCP auto-run copies
  wrote no timing at all; they are now one autoRun helper.
- SSH output was buffered to completion and discarded entirely on timeout.
  Both sshExec copies now stream through a shared execlog sink into
  execution_logs, and keep partial output when a command is cancelled.
- executions.correlation_id was a random per-execution uuid that correlated
  nothing; it is now the chat session id, which is what lets the chat tail
  live output.
- reversible_low had no auto-run branch despite policy declaring it
  unattended. Since computeCommandRisk never returns it, the class only arises
  when an agent declares it over a read_only command — so gating it penalised
  candor without adding safety.
- backup-target gains a backup-freshness checker (portable find -mmin, since
  the first target is on macOS), resolving its host by walking backs-up-to
  backwards. The pre-deploy pg_dump is now a tracked backup target.

UI: an Executions section on entity detail with live output tailing, and
streamed output under a running `run` call in the chat timeline.

Migrations 022-024. Ops.svelte and context.ts exclude execution.output from
their refetch triggers, which would otherwise fire once a second per command.

Co-Authored-By: Claude <noreply@anthropic.com>

seeds/inventory.yaml

@@ -201,7 +201,17 @@ entities:
   - {slug: "volume:media-local", type: volume, name: media-local,
      attributes: {path: /mnt/media_local}}
   - {slug: "backup:proton-drive", type: backup-target, name: proton-drive,
-     attributes: {provider: proton, encrypted: true}}
+     attributes: {provider: proton, encrypted: true,
+                  path: /mnt/backup,
+                  note: "rclone stages here before pushing to Proton; freshness is checked on lxc:rclone via the backs-up-to edge"}}
+  # The pre-deploy pg_dump written by scripts/deploy.sh on every push to main.
+  # It was the lab's only untracked backup: its failure path is `|| echo
+  # WARNING` inside the deploy script, so a broken dump was invisible until a
+  # rollback needed it.
+  - {slug: "backup:oikos-predeploy", type: backup-target, name: oikos-predeploy,
+     attributes: {provider: local, encrypted: false,
+                  path: /opt/oikos/backups,
+                  note: "pre-deploy pg_dump on the mac-mini; one per deployed SHA"}}
 
   # ─── Services ──────────────────────────────────────────────────────
   - {slug: "service:proxmox-ui", type: service, name: proxmox_ui,
@@ -536,6 +546,10 @@ relationships:
   - {source: "lxc:romm", target: "pool:ludo-lvm", type: stores-on}
   - {source: "lxc:teddycloud", target: "pool:local-lvm-hubris", type: stores-on}
   - {source: "lxc:rclone", target: "backup:proton-drive", type: backs-up-to}
+  # The mac-mini writes the pre-deploy dumps, so it is also where the freshness
+  # check runs — checkdefaults resolves a backup-target's host by walking this
+  # edge backwards.
+  - {source: "ws:mac-mini", target: "backup:oikos-predeploy", type: backs-up-to}
 
   # ─── Governance ────────────────────────────────────────────────────
   - {source: "person:dtoro", target: "agent:nomos", type: owns}