fix: transport escalation exempts log reads, get_entity accepts slug alias, add restart_service + push_file tools

P0: Transport escalation in classifyAndGate (server.go:745) now exempts
    log-inspection commands (tail/head/cat/journalctl on *.log or /logs/)
    from the /opt//etc//var/lib/ gating on LXC targets. Fixes the
    'tail -3 /opt/seanime/data/logs/seanime.log queued for approval' bug.

P1: queryEntity returns actionable error when slug_or_id param is empty
    ('slug_or_id is required') instead of silent 'entity not found: '.

P2: Added slugArg() helper (server.go) so get_entity, get_relations,
    get_blast_radius, and explain accept 'slug' as an alias for their
    declared param name. Solves the discoverability inconsistency where
    every tool used a different param name for the same concept.

P3: Two new MCP tools:
    - restart_service(target, service) — systemctl restart wrapper,
      correctly classified config_mutation (requires approval)
    - push_file(target, source_path, dest_path, backup=true) — pct push
      from Proxmox host into LXC, with optional backup. Classified
      config_mutation. LXC-only for now.

P4: Updated homelab-lxc-ops skill with MCP tools preference table.

Plus: Wails desktop build now uses build-tag approach for frontend embed
      (assets_embed.go + assets_stub.go), so go build ./... works on
      clean checkout without the frontend built first.

Version: 0.31.0 → 0.32.0

internal/mcp/entity_tools.go

@@ -24,7 +24,7 @@ func EntityTools(pool *db.Pool, agentID uuid.UUID, sec secretBackend) []toolReg
 					InputSchema: objSchema(prop{"slug_or_id", "string", "Entity slug (e.g. host:hubris) or UUID"}),
 				}, handler: func(ctx context.Context, req *mcp.CallToolRequest) (*mcp.CallToolResult, error) {
 					args := argsMap(req)
-					idOrSlug, _ := args["slug_or_id"].(string)
+					idOrSlug := slugArg(args, "slug_or_id", "slug", "id")
 					return queryEntity(ctx, pool, idOrSlug), nil
 				}},
 				{tool: &mcp.Tool{Name: "list_entities", Description: "List entities filtered by type, state, or search",
@@ -52,7 +52,7 @@ func EntityTools(pool *db.Pool, agentID uuid.UUID, sec secretBackend) []toolReg
 					),
 				}, handler: func(ctx context.Context, req *mcp.CallToolRequest) (*mcp.CallToolResult, error) {
 					args := argsMap(req)
-					slug, _ := args["entity_id"].(string)
+					slug := slugArg(args, "entity_id", "slug")
 					typesStr, _ := args["types"].(string)
 					if slug == "" {
 						return textResult("entity_id is required"), nil
@@ -76,7 +76,7 @@ func EntityTools(pool *db.Pool, agentID uuid.UUID, sec secretBackend) []toolReg
 						prop{"depth", "integer", "Traversal depth (default 3)"}),
 				}, handler: func(ctx context.Context, req *mcp.CallToolRequest) (*mcp.CallToolResult, error) {
 					args := argsMap(req)
-					slug, _ := args["entity_id"].(string)
+					slug := slugArg(args, "entity_id", "slug")
 					depth := int(getFloat(args, "depth", 3))
 					return queryRows(ctx, pool,
 						"SELECT e.slug, CAST(b.depth AS int) FROM blast_radius((SELECT id FROM entities WHERE slug = $1), $2) b JOIN entities e ON e.id = b.entity_id",