Phase 4 (Performance) + Phase 6 (Infrastructure) completion

Phase 4 — Performance:
- F1: SSH DialPool with key-by-host pooling and 5min idle TTL
- F2: In-memory entity lookup cache (TTL 60s, HTTP resolveEntityID)
- F3: Trigram GIN indexes on entities.slug and entities.name (migration 031)
- F4: Partial index on executions(classification_id) for auto-act (migration 032)
- Added missing RunOutput and RunStreaming in actuator/ (E3 gap fill)

Phase 6 — Infrastructure:
- H1: Infisical image pinned to v0.99.1
- H2: execworker daemon — polls pending executions with per-execution
  advisory locks, recovers orphaned running executions, wired as
  docker-compose service
- H3: splitSQL hardened with block comment and string-literal support,
  6 new edge-case tests (11 total)
- H4: Scheduler acquires pg_try_advisory_lock(0x01c05e6) at startup

internal/httpapi/server.go

@@ -55,6 +55,7 @@ type Server struct {
 	pool           *db.Pool
 	cfg            config.Config
 	secretsManager secrets.Backend
+	entityCache    *db.EntityCache
 	sseBroker      *sseBroker
 	sseSubs        map[*sseSubscriber]struct{}
 	sseMu          sync.Mutex
@@ -69,10 +70,11 @@ type Server struct {
 // and pool.Close() deadlocks.
 func NewHandler(ctx context.Context, pool *db.Pool, cfg config.Config) http.Handler {
 	s := &Server{
-		pool:      pool,
-		cfg:       cfg,
-		sseBroker: newSSEBroker(10000),
-		sseSubs:   make(map[*sseSubscriber]struct{}),
+		pool:        pool,
+		cfg:         cfg,
+		entityCache: db.NewEntityCache(60 * time.Second),
+		sseBroker:   newSSEBroker(10000),
+		sseSubs:     make(map[*sseSubscriber]struct{}),
 	}
 
 	// Wire secrets backend: Infisical primary with SOPS DR fallback.