feat(observability): restore monitoring coverage, make gaps visible, stream executions

Monitoring coverage was 3 of 89 active entities. Three bugs, each hidden by
discarded errors in checkdefaults:

- writeCheck generated a fresh uuid, inserted the check entity ON CONFLICT
  (slug) DO NOTHING, then wrote a check_defs row referencing it. On any
  re-seed the slug already existed, the entity insert no-oped, and the FK
  violated — aborting the ingest transaction and surfacing as an unrelated
  failure several entities later. Re-seeding has been broken since; prod's
  coverage was frozen at its first successful seed. This is what
  TestSeedIngestIdempotentAndNoDuplicateEdges had been reporting.
- shortSlug truncated to the last 8 chars, so all 21 ingress routes collapsed
  to ".network" and overwrote each other; service:jellyfin collided with
  lxc:jellyfin.
- The ssh-script checker never read the `args` config checkdefaults wrote, so
  process_check.sh always ran without its unit name and returned "unknown".

Coverage is now 75/89. Monitoring is declared per entity type in
seeds/ontology.yaml and resolved through the is-a hierarchy, so a type can say
it warrants nothing (site, lan, mesh, cluster) and never be reported as a gap.
coverageSweep raises an `unmonitored` signal only where a type declares
monitoring it lacks — 8 real gaps, no false positives.

Also:
- entity_types.attribute_schema was never ingested: the seed loader read
  "attribute_schema" but the YAML says "attributes", so all 60 types stored
  JSON null.
- ListExecutions ignored its declared target/action/correlation_id filters and
  paginated on a non-unique target slug, dropping and repeating rows.
- started_at was captured but only written at terminal state, so a running
  execution reported NULL for its whole life. The three MCP auto-run copies
  wrote no timing at all; they are now one autoRun helper.
- SSH output was buffered to completion and discarded entirely on timeout.
  Both sshExec copies now stream through a shared execlog sink into
  execution_logs, and keep partial output when a command is cancelled.
- executions.correlation_id was a random per-execution uuid that correlated
  nothing; it is now the chat session id, which is what lets the chat tail
  live output.
- reversible_low had no auto-run branch despite policy declaring it
  unattended. Since computeCommandRisk never returns it, the class only arises
  when an agent declares it over a read_only command — so gating it penalised
  candor without adding safety.
- backup-target gains a backup-freshness checker (portable find -mmin, since
  the first target is on macOS), resolving its host by walking backs-up-to
  backwards. The pre-deploy pg_dump is now a tracked backup target.

UI: an Executions section on entity detail with live output tailing, and
streamed output under a running `run` call in the chat timeline.

Migrations 022-024. Ops.svelte and context.ts exclude execution.output from
their refetch triggers, which would otherwise fire once a second per command.

Co-Authored-By: Claude <noreply@anthropic.com>

web/src/lib/stores/activity.ts

@@ -1,6 +1,7 @@
 import { derived, type Readable } from 'svelte/store'
 import { messages, chatFor, type ChatMessage, type ToolCallResult } from './chat'
 import { planSteps, currentTask, workspaceFor, taskFor } from './workspace'
+import { liveExecutionOutputFor, type LiveExecutionOutput } from './execstream'
 import type { PlanStep, Session } from '$lib/api'
 
 export { type ToolCallResult }
@@ -28,6 +29,10 @@ export interface ActivityEntry {
   stepSeq?: number
   indent?: boolean
   status: 'running' | 'done' | 'failed'
+  // Command output streaming in while a `run` tool call is still executing.
+  // Distinct from `detail`, which is only populated once the tool_result
+  // arrives — for an auto-run that is the moment the command finishes.
+  liveOutput?: string
 }
 
 // Detail text is kept full-length (not hard-truncated to a preview snippet)
@@ -199,12 +204,31 @@ export const activityLog = derived([messages, planSteps, currentTask], ([$msgs,
   computeActivityLog($msgs, $steps, $task)
 )
 
+// Attach streaming output to the `run` entry that is currently executing.
+// Nomos runs tools sequentially, so the last still-running run entry is the
+// one the output belongs to.
+function withLiveOutput(
+  entries: ActivityEntry[],
+  live: LiveExecutionOutput | null
+): ActivityEntry[] {
+  if (!live?.output) return entries
+  for (let i = entries.length - 1; i >= 0; i--) {
+    const e = entries[i]
+    if (e.type === 'tool_running' && e.status === 'running' && e.toolName === 'run') {
+      entries[i] = { ...e, liveOutput: live.output }
+      break
+    }
+  }
+  return entries
+}
+
 export function activityLogFor(sessionId: string): Readable<ActivityEntry[]> {
   const chat = chatFor(sessionId)
   const ws = workspaceFor(sessionId)
   const task = taskFor(sessionId)
-  return derived([chat.messages, ws.planSteps, task], ([$msgs, $steps, $task]) =>
-    computeActivityLog($msgs, $steps, $task)
+  const live = liveExecutionOutputFor(sessionId)
+  return derived([chat.messages, ws.planSteps, task, live], ([$msgs, $steps, $task, $live]) =>
+    withLiveOutput(computeActivityLog($msgs, $steps, $task), $live)
   )
 }